CVE-2026-74296

A flaw was found in the RDMA/mlx5 component of the Linux kernel. This vulnerability occurs due to an incorrect User Access Register (UAR) index release, where the software-provided index is freed instead of the hardware-provided one. This improper resource management could potentially lead to resource exhaustion or system instability, impacting the availability of the system.

This vulnerability is rated Moderate rather than Important because exploitation requires local access and is restricted to environments utilizing Mellanox InfiniBand or RoCE hardware adapters. Systems without Mellanox ConnectX network interfaces or those that do not use RDMA capabilities are not exposed to this flaw. In affected configurations, an authenticated local user can trigger erroneous User Access Register deallocation during resource cleanup, leading to resource depletion or denial of service without directly compromising system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.