CVE-2026-68139: Linux kernel · net/mlx5e: Use sender devcom for MPV master-up
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in e32649b4bad90a6216d8e93cd7dd050af8ac9740 : patch Linux kernel soon.
Data as of 6 Nov 2026, 18:18 UTC
Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in e32649b4bad90a6216d8e93cd7dd050af8ac9740, c698b2735613f1f35c55688bd2252f75f31c49ad, a60c81f168c9fe4f5d84302d1e32b717f5a8a933 +1
Exploitation evidence
Disclosed: evidence found.
CVE published 10 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade Linux kernel to e32649b4bad90a6216d8e93cd7dd050af8ac9740, c698b2735613f1f35c55688bd2252f75f31c49ad, a60c81f168c9fe4f5d84302d1e32b717f5a8a933 or 40f9a124ebbe0d60fe165fb3f87515c35b2d72f5.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
Debiandebian/linuxpkg:deb/debian/linuxOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available and included in Linux kernel version 6.7. Users should upgrade to this version or later to remediate the issue. No additional mitigation steps are indicated or required.
Description
A NULL pointer dereference vulnerability in the Linux kernel's mlx5e driver was fixed. The flaw occurs during PCIe DPC recovery when multiport affiliation events are replayed, leading to a kernel panic due to a NULL pointer dereference in mlx5_devcom_comp_set_ready. The issue arises because a concurrent master-up event can access a peer whose private data is visible but whose devcom backpointer is still NULL. The fix uses the sender devcom component to avoid this NULL dereference.
References
- git.kernel.org/stable/c/c698b2735613f1f35c55688bd2252f75f31c49ad (opens in a new tab)
- git.kernel.org/stable/c/40f9a124ebbe0d60fe165fb3f87515c35b2d72f5 (opens in a new tab)
- git.kernel.org/stable/c/a60c81f168c9fe4f5d84302d1e32b717f5a8a933 (opens in a new tab)
- git.kernel.org/stable/c/e32649b4bad90a6216d8e93cd7dd050af8ac9740 (opens in a new tab)