CVE-2026-22996

A NULL pointer dereference vulnerability was found in the Mellanox mlx5 Ethernet driver in the Linux kernel. The driver stores a pointer to mlx5e_priv in the devlink private data, but this structure can be zeroed out (memset to 0) when profile attachment fails. Subsequent access to the zeroed structure during device removal causes a NULL pointer dereference and kernel crash.

This vulnerability is triggered when switchdev mode enablement fails due to profile change errors. The issue manifests during device reload operations via devlink after a previous failure. While the crash requires a specific failure sequence, it can be triggered by administrative operations on Mellanox network devices.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.