Linux kernel i2c-mlxbf (BlueField DPU I2C controller): mlxbf_i2c_init_resource() frees a resource struct and then reads

CVE-2026-72140Firmware, BMC & network fabrici2c: mlxbf use-after-free in mlxbf_i2c_init_resource()curated

Impact

mlxbf_i2c_init_resource() frees a resource struct and then reads a field out of it to build the error code - a use-after-free on the DPU during I2C controller initialisation. Same subsystem as the earlier BlueField I2C stack overflow, which is the real signal: the DPU's platform glue has repeatedly shipped memory-safety bugs, and that is the layer your infrastructure services sit on.

Who can reach it

Local on the DPU, reached on the I2C init error path during driver probe.

What to do

Upgrade the DPU Arm-side kernel to 7.2 or one of the wide stable backports (5.10.261 through 7.1.5), delivered as a DOCA/BFOS package upgrade or BFB re-image plus DPU reset. Low urgency alone - bundle into the next BFB refresh alongside the other BlueField platform fixes.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-72140 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-72140.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.