CVE-2026-72006
Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5_st_idx_data on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints (e.g. churning RDMA MRs) leak one struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced and the kmalloc slab grows over time. When the last reference to an ST table entry is dropped, mlx5_st_dealloc_index() removed the entry from idx_xa but the backing mlx5_st_idx_data allocation was never freed. Free idx_data after the xa_erase() so the lifetime of the bookkeeping struct matches the lifetime of the ST entry it tracks.
How to fix
- Linux Linux262da8b6ea03d01ee7ed01ad309e4c89941f6b14, 6eb4cf2fa8997f62c11e0006dc010a1fd89c5a75, df6134b527a88b3e65ba6ae5073664af091d5fd2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 888a7776f4fb04c19bec70c737c61c2f383c6b1e ≤ v < 262da8b6ea03d01ee7ed01ad309e4c89941f6b14, 888a7776f4fb04c19bec70c737c61c2f383c6b1e ≤ v < 6eb4cf2fa8997f62c11e0006dc010a1fd89c5a75, 888a7776f4fb04c19bec70c737c61c2f383c6b1e ≤ v < df6134b527a88b3e65ba6ae5073664af091d5fd2, 6.17 | 262da8b6ea03d01ee7ed01ad309e4c89941f6b14, 6eb4cf2fa8997f62c11e0006dc010a1fd89c5a75, df6134b527a88b3e65ba6ae5073664af091d5fd2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.