CVE-2026-74395 addresses a null pointer dereference in the Linux kernel's RDMA mlx5 driver. Specifically, MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list before initializing fields used in the shared error path. If eventfd_ctx_fdget() fails, the unwind path dereferences event_sub->ev_file in uverbs_uobject_put() and calls subscribe_event_xa_dealloc() with an uninitialized xa_key_level1. Since subscribe_event_xa_alloc() creates the XA entry once per key_level1, the unwind path must call subscribe_event_xa_dealloc() exactly once. The fix adds devx_key_in_sub_list() to ensure subscribe_event_xa_dealloc() is called only when the last matching pending entry is cleaned up, preventing the NULL dereference.

The vulnerability can cause a kernel NULL pointer dereference, potentially leading to a denial of service (system crash) when the error path is triggered. There is no indication of privilege escalation or code execution. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this issue by enforcing proper cleanup of subscription entries and preventing NULL dereferences. Users should apply the official Linux kernel updates that include this patch. Since this is not a cloud service, remediation requires updating affected Linux kernel versions once the patch is available. Patch status is not yet confirmed in the provided data; check the vendor advisory for the latest remediation guidance.