CVE-2026-93109

A flaw was found in the Linux kernel's RDMA/mlx5 component. A race condition during module teardown can occur when the mlx5_ib module unloads before all Read-Copy-Update (RCU) callbacks, such as devx_free_subscription(), have completed. This premature unloading while callbacks are still pending can lead to system instability or a crash, resulting in a Denial of Service.

This vulnerability is rated as Moderate severity because exploitation is restricted to environments utilizing Mellanox InfiniBand or RoCE hardware and requires specific driver unloading or device detachment sequences. Triggering the race condition requires active DevX subscriptions during module teardown, an event typically initiated only during administrative maintenance or hardware removal. The practical impact is confined to a local denial of service via a kernel crash, without compromising data confidentiality or system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.