Linux Kernel Vulnerability Affecting MLX5 Driver

CVE-2026-80880

What is CVE-2026-80880?

A vulnerability in the Linux kernel's MLX5 driver related to implicit On-Demand Paging (ODP) has been identified where modifications to parent memory keys (mkeys) are not effectively processed in place. Any request for a change necessitates a complete reconstruction of the parent mkey due to the configuration of its child mkeys. The absence of user-specified translations forces the implicit values to be utilized, which then triggers the mlx5_ib_reg_user_mr() function. This design flaw introduces potential racing conditions related to access permissions on mkeys, highlighting a critical area for performance and security optimizations within the driver.

References