CVE-2026-98217

A flaw was found in the Linux kernel's mlx4 InfiniBand driver that can result in a Denial of Service (DoS). When device registration encounters an error during setup, the driver frees memory objects associated with partition key interfaces but retains their references. A subsequent device cleanup operation attempts to release these invalid pointers, triggering a use-after-free condition. A local attacker could exploit this issue to cause memory corruption and crash the system.

A use after free can occur in the IB mlx4 pkey sysfs registration path when register_one_pkey_tree() fails for one slave. The error path releases the pkey parent kobjects but leaves their pointers stored in the device, while registration continues for the remaining slaves. A later device cleanup can pass one of these stale pointers to kobject_put(), causing a second operation on an object that may already have been freed or reused. The demonstrated impact is at least a local denial of service through a kernel crash. For the CVSS the PR:L value in the paranoid score applies when a local user, container, or service account has delegated control over an RDMA device, VF, or device lifecycle. Typical systems without such delegation instead require administrative privileges and are better represented by PR:H. AC:H applies because exploitation depends on a pkey sysfs registration failure followed by later device cleanup. The issue is not directly network reachable and requires an affected mlx4 device and the vulnerable registration path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.