{ "cveId": "CVE-2026-72341", "url": "https://patchblox.com/security/cve/CVE-2026-72341", "summary": "CVE-2026-72341 is fixed in 35 products on 1 platform, first by DEBIAN-CVE-2026-72341, released August 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "net/mlx5e: Fix publication race for priv-\u003Echannel_stats[]", "description": "In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix publication race for priv-\u003Echannel_stats[] mlx5e_channel_stats_alloc() publishes a new entry to priv-\u003Echannel_stats[] and then increments priv-\u003Estats_nch as a publication token, but neither store carries any memory barrier: \tpriv-\u003Echannel_stats[ix] = kvzalloc_node(...); \tif (!priv-\u003Echannel_stats[ix]) \t\treturn -ENOMEM; \tpriv-\u003Estats_nch\u002B\u002B; Concurrent readers compute the loop bound from priv-\u003Estats_nch and then dereference priv-\u003Echannel_stats[i] using plain accesses, e.g. \tfor (i = 0; i \u003C priv-\u003Estats_nch; i\u002B\u002B) { \t\tstruct mlx5e_channel_stats *cs = priv-\u003Echannel_stats[i]; \t\t... cs-\u003Erq.packets ... \t} On weakly-ordered architectures (ARM, PowerPC, RISC-V) the writes to channel_stats[ix] and stats_nch may become visible to other CPUs out of program order. A reader can observe stats_nch == N while still seeing channel_stats[N-1] == NULL, leading to a NULL pointer dereference in the channel_stats loop. This has been observed in production on BlueField-3 DPUs (arm64), where ovs-vswitchd queries netdev statistics over netlink during NIC bringup, racing mlx5e_open_channel() -\u003E mlx5e_channel_stats_alloc() on another CPU: Unable to handle kernel NULL pointer dereference at virtual address 0x840 Hardware name: BlueField-3 DPU pc : mlx5e_fold_sw_stats64\u002B0x30/0x180 [mlx5_core] Call trace: mlx5e_fold_sw_stats64\u002B0x30/0x180 [mlx5_core] dev_get_stats\u002B0x50/0xc0 ovs_vport_get_stats\u002B0x38/0xac [openvswitch] ovs_vport_cmd_fill_info\u002B0x194/0x290 [openvswitch] ovs_vport_cmd_get\u002B0xbc/0x10c [openvswitch] genl_family_rcv_msg_doit\u002B0xd0/0x160 genl_rcv_msg\u002B0xec/0x1f0 netlink_rcv_skb\u002B0x64/0x130 genl_rcv\u002B0x40/0x60 netlink_unicast\u002B0x2fc/0x370 netlink_sendmsg\u002B0x1dc/0x454 ... __arm64_sys_sendmsg\u002B0x2c/0x40 Add mlx5e_stats_nch_write() and mlx5e_stats_nch_read() helpers in en.h that wrap the smp_store_release()/smp_load_acquire() pair on stats_nch. The release/acquire pair establishes the contract: stats_nch == N =\u003E channel_stats[0..N-1] are visible and non-NULL. Publish the stats_nch increment via mlx5e_stats_nch_write() in the writer (mlx5e_channel_stats_alloc()), and read stats_nch via mlx5e_stats_nch_read() in all readers: mlx5e RX/TX queue stats, mlx5e_get_base_stats(), ethtool channels stats, IPoIB stats, the sw_stats fold and the HV VHCA stats agent.", "published": "2026-08-15T06:22:07Z", "severity": "Moderate", "cvss": 4.7, "epss": 0.00223, "epssPercentile": 0.12998, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72341", "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "dtb-aarch64", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-64kb", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-azure", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-azure", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-default", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-default", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1.160000.2.22", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1.150700.17.45.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-default-base", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1.160000.2.23", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-docs", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-docs", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-kvmsmall", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.41-94.142", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP7-RT_Update_20", "release": "sles 15.7", "fixedVersion": "1-150700.1.3.1", "fix": "SUSE-SU-2026:4120-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4120-1", "released": "2026-09-10T09:31:34Z" }, { "platform": "linux", "product": "kernel-livepatch-SLE15-SP7_Update_21", "release": "sles 15.7", "fixedVersion": "1-150700.15.3.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-obs-build", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-obs-qa", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-rt", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-source", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-source", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-syms", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-syms", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "opensuse-leap 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "OPENSUSE-SU-2026:21910-1", "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-21910-1", "released": "2026-09-22T15:26:20Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 15.7", "fixedVersion": "6.4.0-150700.53.81.1", "fix": "SUSE-SU-2026:4254-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4254-1", "released": "2026-10-07T22:31:36Z" }, { "platform": "linux", "product": "kernel-zfcpdump", "release": "sles 16.0", "fixedVersion": "6.12.0-160000.38.1", "fix": "SUSE-SU-2026:23902-1", "url": "https://patchblox.com/security/fix/linux/suse-su-2026-23902-1", "released": "2026-09-22T14:23:31Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.12.115-2", "fix": "DEBIAN-CVE-2026-72341", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-72341", "released": "2026-08-15T22:38:55Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "7.1.5-1", "fix": "DEBIAN-CVE-2026-72341", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-72341", "released": "2026-08-15T22:38:55Z" }, { "platform": "linux", "product": "microvm-kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.41-94.142.amzn2023", "fix": "ALAS2023-2026-2071", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-2071", "released": "2026-08-31T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T07:25:28Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }