CVE-2026-90128

A flaw was found in the Linux kernel's vdpa/mlx5 driver. An error in the add_direct_chain() function's cleanup path causes the system to iterate over an incorrect list. This could lead to improper memory handling during error conditions, potentially resulting in system instability or a denial of service.

add_direct_chain in vdpa mlx5 used the wrong list in the allocation error cleanup path. Newly allocated direct MR entries were stored on a temporary list, but the error path iterated mr head instead of tmp. This can incorrectly unmap and free existing MR entries while leaving the newly allocated temporary entries uncleared, resulting in corrupted memory registration state and possible resource leakage. For the CVSS the PR:L is used in the paranoid score because some environments delegate vDPA or device management to reduced capability root, container root, or a service account rather than full host administration. The issue is local and is not directly network reachable. Impact is mainly denial of service against the vDPA device or dependent guest workloads, with limited confidentiality or integrity impact possible only from corrupted MR state.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.