CVE-2026-74296

HighCVSS 7.8

Published: 15/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

In the Linux kernel, the RDMA/mlx5 driver has a bug where it frees the software-provided UAR index instead of the hardware-provided one. The fix is to free the UAR index returned by the hardware.

Risk Assessment

The bug could lead to improper management of UAR resources, potentially causing crashes or malfunction of the driver.

Recommendation

Apply the Linux kernel patch for CVE-2026-74296. Verify that systems using mlx5 work correctly after the update.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware.