## Summary
CVE-2026-74296 fixes a Linux kernel RDMA (mlx5) resource management bug where the driver deallocates the wrong UAR (User Access Region) index. The patch changes the mlx5_cmd_uar_dealloc() call to use the hardware-provided uar_index rather than the software index.
## Technical Details
- Component: drivers/infiniband/hw/mlx5/main.c in the RDMA/mlx5 driver.
- The fix replaces the deallocation parameter passed to mlx5_cmd_uar_dealloc(dev->mdev, ...):
- Before: mlx5_cmd_uar_dealloc(dev->mdev, idx, context->devx_uid)
- After: mlx5_cmd_uar_dealloc(dev->mdev, uar_index, context->devx_uid)
- The stable backports reference the same upstream change (upstream commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1).
- Backport commits shown in references:
- 6f83de384ca582fa87b4c2b0d03bd1ed3bf9a2ee
- 80f1f49f53a42733e60c90e0ec545e647969214d
- The NVD description indicates the resolved issue is: “Release the HW‑provided UAR index rather than the SW one”.
## Affected
- Linux kernel RDMA driver: RDMA/mlx5 (NVIDIA mlx5 InfiniBand/RDMA stack).
- Affected code path is in drivers/infiniband/hw/mlx5/main.c where UAR deallocation occurs during an error/cleanup flow.
## Impact
- Incorrect UAR deallocation can lead to memory/resource corruption or use-after-free conditions in the driver’s hardware mapping lifecycle.
- CVSS provided by the request: 7.8 (Local attack vector AV:L, privileges required PR:L).
## Mitigation
1. Apply the kernel patch that changes mlx5_cmd_uar_dealloc() to use uar_index (upstream commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1, and stable backports 6f83de384ca582fa87b4c2b0d03bd1ed3bf9a2ee / 80f1f49f53a42733e60c90e0ec545e647969214d).
2. Rebuild and redeploy the updated kernel so the corrected deallocation logic is active in drivers/infiniband/hw/mlx5/main.c.
3. If you cannot patch immediately, reduce exposure by limiting local access to RDMA/DEVX functionality that triggers the affected cleanup path (since the vector is AV:L and PR:L).
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H