Linux kernel (drivers/infiniband/hw/mlx5): When on-demand-paging translation-table population fails, the UMR path

CVSS 7.5CVE-2026-74396Firmware, BMC & network fabriccurated

Impact

When on-demand-paging translation-table population fails, the UMR path returns without running its cleanup: the DMA mapping and buffer leak, and if the shared emergency translation page was in use its global mutex is left permanently locked. Every subsequent memory-region update on that node then blocks forever - the RDMA stack wedges for all tenants on the box, not just the one that hit the failure.

Who can reach it

Requires Mellanox/NVIDIA mlx5 with ODP in use - the standard NIC under most GPU clusters. Triggered from a tenant container holding /dev/infiniband/uverbs* that registers on-demand-paging memory regions and drives the populate failure. The CNA scored it network-reachable with no privileges, reflecting that page-fault population is also driven by remote RDMA traffic against the tenant's ODP regions.

What to do

No fixed version is listed in the record - take the stable kernel carrying ffa85a2c1979 (or 9619909d4869 / 1eae35b37923) and reboot; once the mutex is stuck only a reboot clears it. Interim: disable ODP (do not advertise implicit ODP to tenants) on nodes that do not need it.

References

https://git.kernel.org/stable/c/ffa85a2c197935ace6f1634ad9eb0a44bc615670 https://git.kernel.org/stable/c/9619909d4869afe720904c6888a289b9ac3055b8 https://nvd.nist.gov/vuln/detail/CVE-2026-74396

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.