CVE-2026-72343

A flaw was found in the net/mlx5e component of the Linux kernel. A zero-sized buffer is allocated during the initialization of HV VHCA statistics. When the hypervisor later attempts to enable statistics reporting, a write operation is performed on this invalid memory address. This can lead to a kernel crash, resulting in a Denial of Service (DoS) for the system.

This vulnerability is rated as Moderate impact because triggering the flaw requires specific hardware configurations—namely Mellanox ConnectX devices operating in a Hyper-V virtualized environment where hypervisor statistics reporting is active. While an invalid memory dereference occurs during statistics collection, the resulting failure causes a kernel panic leading to system denial of service without permitting privilege escalation or arbitrary code execution. Consequently, standard deployments lacking Mellanox network hardware or not hosted under Hyper-V are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.