---
id: CVE-2026-72342
title: 'net/mlx5e: Fix HV VHCA stats agent registration race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/mlx5e: Fix HV VHCA stats agent registration race

  mlx5e_hv_vhca_stats_create() registers the stats agent through
  mlx5_hv_vhca_agent_create(). The helper publishes t…
severity: high
cvss: 8.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 <
    b0fd6d3bb06182f19f3b59a53f57b5098b99048a
  - >-
    Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 <
    24c77044cdfcf5b8b2e9f3b620d8b9aa392d9add
  - >-
    Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 <
    e8fc3304cb67fb1d7d11ff9ef9abd5fb64e7e1d5
  - >-
    Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 <
    60fddda7207d81fea71463abd403f0b10f74f2e1
  - >-
    Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 <
    f5677797b094c3ec5fb350eb8ea7710b88a3d018
  - >-
    Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 <
    89b25b5f46f488ea3b29b3444864c76944c9075b
  - Linux 5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:47:25.346800Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:55:19.106Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72342'
references:
  - url: 'https://git.kernel.org/stable/c/b0fd6d3bb06182f19f3b59a53f57b5098b99048a'
  - url: 'https://git.kernel.org/stable/c/24c77044cdfcf5b8b2e9f3b620d8b9aa392d9add'
  - url: 'https://git.kernel.org/stable/c/e8fc3304cb67fb1d7d11ff9ef9abd5fb64e7e1d5'
  - url: 'https://git.kernel.org/stable/c/60fddda7207d81fea71463abd403f0b10f74f2e1'
  - url: 'https://git.kernel.org/stable/c/f5677797b094c3ec5fb350eb8ea7710b88a3d018'
  - url: 'https://git.kernel.org/stable/c/89b25b5f46f488ea3b29b3444864c76944c9075b'
tags:
  - cve.org
epss: 0.00196
epssPercentile: 0.08642
ingestedAt: '2026-10-16T19:46:24.405Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix HV VHCA stats agent registration race

mlx5e_hv_vhca_stats_create() registers the stats agent through
mlx5_hv_vhca_agent_create(). The helper publishes the agent in
hv_vhca->agents[type] under agents_lock and immediately schedules an
asynchronous control invalidation on the HV VHCA workqueue before
returning to mlx5e.

The asynchronous invalidation invokes the control agent's invalidate
callback, which reads the hypervisor control block and forwards the
command to mlx5e_hv_vhca_stats_control(). That callback may either:

  - call cancel_delayed_work_sync(&priv->stats_agent.work), or
  - call queue_delayed_work(priv->wq, &sagent->work, sagent->delay).

However, the delayed_work and priv->stats_agent.agent are only
initialized after mlx5_hv_vhca_agent_create() returns to mlx5e:

    agent = mlx5_hv_vhca_agent_create(...);   /* publish + invalidate */
    ...
    priv->stats_agent.agent = agent;          /* too late */
    INIT_DELAYED_WORK(&priv->stats_agent.work, ...); /* too late */

If the asynchronous control path runs before the two assignments
above, it can:

  - Operate on an uninitialized delayed_work whose timer.function is
    NULL. queue_delayed_work() calls add_timer() unconditionally, so
    when the timer expires the timer softirq invokes a NULL function
    pointer.
  - Re-initialize the timer later through INIT_DELAYED_WORK() while
    the timer is already enqueued in the timer wheel, corrupting the
    hlist (entry.pprev cleared while the previous bucket node still
    points at this entry).
  - When the worker eventually runs, mlx5e_hv_vhca_stats_work() reads
    sagent->agent (NULL) and dereferences it inside
    mlx5_hv_vhca_agent_write().

Fix this by:

  - Initializing priv->stats_agent.work before invoking
    mlx5_hv_vhca_agent_create(), so the work is always in a valid
    state when the control callback observes it.
  - Adding a struct mlx5_hv_vhca_agent **ctx_update out-parameter
    to mlx5_hv_vhca_agent_create(). The helper writes the agent
    pointer to *ctx_update before publishing into hv_vhca->agents[]
    and triggering the agents_update flow, so any callback
    subsequently invoked from that flow already sees a valid
    priv->stats_agent.agent. This avoids having the control
    callback participate in agent initialization.

While at it, access priv->stats_agent.agent with
READ_ONCE()/WRITE_ONCE() for the cross-CPU access with the worker, and
clear priv->stats_agent.buf on the agent_create() failure path.

## Affected

- `Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 < b0fd6d3bb06182f19f3b59a53f57b5098b99048a`
- `Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 < 24c77044cdfcf5b8b2e9f3b620d8b9aa392d9add`
- `Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 < e8fc3304cb67fb1d7d11ff9ef9abd5fb64e7e1d5`
- `Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 < 60fddda7207d81fea71463abd403f0b10f74f2e1`
- `Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 < f5677797b094c3ec5fb350eb8ea7710b88a3d018`
- `Linux >= cef35af34d6dc3792333075115c7deb7062b6e18 < 89b25b5f46f488ea3b29b3444864c76944c9075b`
- `Linux 5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.