CVE-2026-72072

This CVE exposes a race condition in mlx5e MACsec where three separately-reasonable synchronization models—xaarray RCU semantics, dst reference counting, and weak-memory-order architecture assumptions—interact to produce a UAF invisible on x86 but exploitable on ARM64 and POWER. The metadata_dst gets published via xa_alloc() before its fields are fully initialized, and dst_release() unconditionally calls kfree() without RCU grace period accounting, allowing a reader under rcu_read_lock() to observe freed memory. The advisory explicitly defers a second, identical UAF pattern (sc_xarray_element freed without RCU grace period) to a follow-up patch. This is the critical detail: the scored vulnerability (CVSS 7.8) describes the pre-patch state, but production systems will run the partial fix while a second known UAF remains exploitable. An attacker monitoring CVE disclosures gains adversarial intelligence about exactly which race to target—the one left unfixed. On x86, the initialization-before-publish race is masked by strong memory ordering. On ARM64 or POWER, a non-NULL pointer may become observable before its fields are coherent, or a freed object may be stale. This means the bug likely existed silently in production on non-x86 deployments while passing developer testing on x86 workstations. Your testing infrastructure's architecture bias contributed to this going undetected. The deferred fix is not scheduling debt—it is a documented residual risk accepted and shipped. The mlx5 driver family now spans at least three CVE genealogies with the same root signature: dst reference counting paired with RCU readers without proper grace period accounting. This pattern suggests the synchronization model itself is structurally unsound. Treat any partial fix for this class of bug as a signal to audit the entire md_dst and xarray interaction surface, not just the immediate vulnerable path. Assume additional races of the same class exist until proven otherwise.

Reviewed through automated stages and approved by a human before publication.