Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/lib): Every memory-key allocation carrying a steering-tag hint

CVSS 5.5CVE-2026-72006Firmware, BMC & network fabriccurated

Impact

Every memory-key allocation carrying a steering-tag hint leaks a small kernel structure when the key is released. A tenant that registers and deregisters RDMA memory regions in a loop grows the host's kernel slab without bound until the node runs out of memory - a noisy-neighbour path from an unprivileged RDMA workload to an out-of-memory event for every tenant on the box.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* that churns memory-region registration/deregistration on an mlx5 device drives it directly; this is the normal steady-state path, not an error path. Conditional on the mkeys carrying TPH steering-tag hints, which the RDMA stack sets for hinted registrations on supporting hardware.

What to do

Update to a kernel carrying the fix on your stream. Interim: cap tenant RDMA registration rates where possible, monitor kernel slab growth on nodes exporting verbs to tenants, and withhold /dev/infiniband/* from workloads that do not need it.

References

https://git.kernel.org/stable/c/262da8b6ea03d01ee7ed01ad309e4c89941f6b14 https://git.kernel.org/stable/c/6eb4cf2fa8997f62c11e0006dc010a1fd89c5a75 https://nvd.nist.gov/vuln/detail/CVE-2026-72006

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.