CVE-2026-98791Medium· 4.4▾ SunlitA flaw was found in the Linux kernel's Mellanox network driver (mlx5e). A local user can exploit this vulnerability to cause a denial of service (DoS) through a system crash. During the teardown of an AF_XDP (eXpress Data Path) transmit qu…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 4.4
none → medium
A flaw was found in the Linux kernel's Mellanox network driver (mlx5e). A local user can exploit this vulnerability to cause a denial of service (DoS) through a system crash. During the teardown of an AF_XDP (eXpress Data Path) transmit queue, outstanding descriptors requesting a transmit timestamp are completed without a completion queue entry, resulting in a NULL pointer dereference.
kernel: net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-23.
Affected:
No fix planned:
Not affected:
Out of support scope
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98876Medium· 4.1kernel: host1x: bus: Fix missing ops null check in error teardown (CVE-2026-98876)
CVE-2026-98877Medium· 4.7kernel: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed (CVE-2026-98877)
CVE-2026-80813Medium· 5.7kernel: nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (CVE-2026-80813)
CVE-2026-80816Medium· 4.6kernel: ALSA: FCP: Use a private URB for the notification endpoint (CVE-2026-80816)
CVE-2025-38733Medium· 5.5kernel: Linux kernel: Denial of Service due to incorrect lowcore memory mapping (CVE-2025-38733)
CVE-2023-54258Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential oops in cifs_oplock_break With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send th…