CVE-2026-68139

A flaw was found in the net/mlx5e driver within the Linux kernel. This vulnerability occurs during PCIe DPC (Downstream Port Containment) recovery when multiport affiliation events are replayed. A race condition can lead to a NULL pointer dereference if a concurrent master-up event accesses uninitialized private data. Successful exploitation of this flaw can cause a kernel panic, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Moderate severity because triggering the denial of service requires local system access on physical hardware equipped with Mellanox adapters, alongside an uncommon PCIe error-recovery cycle. The condition stems from an internal race window when multiport bindings re-initialize during bus recovery, leading to an unhandled pointer dereference and system crash. Systems lacking the corresponding network hardware or operating in virtualized environments without PCI passthrough are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.