In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Always stop health timer during driver removal
Currently, if teardown_hca fails to execute during driver removal, mlx5 does not stop the health timer. Afterwards, mlx5 continue with driver teardown. This may lead to a UAF bug, which results in page fault Oops[1], since the health timer invokes after resources were freed.
Hence, stop the health monitor even if teardown_hca fails.
[1] mlx5_core 0000:18:00.0: E-Switch: Unload vfs: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) mlx5_core 0000:18:00.0: E-Switch: cleanup mlx5_core 0000:18:00.0: wait_func:1155:(pid 1967079): TEARDOWN_HCA(0x103) timeout. Will cause a leak of a command resource mlx5_core 0000:18:00.0: mlx5_function_close:1288:(pid 1967079): tear_down_hca failed, skip cleanup BUG: unable to handle page fault for address: ffffa26487064230 PGD 100c00067 P4D 100c00067 PUD 100e5a067 PMD 105ed7067 PTE 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Tainted: G OE ------- --- 6.7.0-68.fc38.x86_64 #1 Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0013.121520200651 12/15/2020 RIP: 0010:ioread32be+0x34/0x60 RSP: 0018:ffffa26480003e58 EFLAGS: 00010292 RAX: ffffa26487064200 RBX: ffff9042d08161a0 RCX: ffff904c108222c0 RDX: 000000010bbf1b80 RSI: ffffffffc055ddb0 RDI: ffffa26487064230 RBP: ffff9042d08161a0 R08: 0000000000000022 R09: ffff904c108222e8 R10: 0000000000000004 R11: 0000000000000441 R12: ffffffffc055ddb0 R13: ffffa26487064200 R14: ffffa26480003f00 R15: ffff904c108222c0 FS: 0000000000000000(0000) GS:ffff904c10800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffa26487064230 CR3: 00000002c4420006 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <IRQ> ? __die+0x23/0x70 ? page_fault_oops+0x171/0x4e0 ? exc_page_fault+0x175/0x180 ? asm_exc_page_fault+0x26/0x30 ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] ? ioread32be+0x34/0x60 mlx5_health_check_fatal_sensors+0x20/0x100 [mlx5_core] ? __pfx_poll_health+0x10/0x10 [mlx5_core] poll_health+0x42/0x230 [mlx5_core] ? __next_timer_interrupt+0xbc/0x110 ? __pfx_poll_health+0x10/0x10 [mlx5_core] call_timer_fn+0x21/0x130 ? __pfx_poll_health+0x10/0x10 [mlx5_core] __run_timers+0x222/0x2c0 run_timer_softirq+0x1d/0x40 __do_softirq+0xc9/0x2c8 __irq_exit_rcu+0xa6/0xc0 sysvec_apic_timer_interrupt+0x72/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:cpuidle_enter_state+0xcc/0x440 ? cpuidle_enter_state+0xbd/0x440 cpuidle_enter+0x2d/0x40 do_idle+0x20d/0x270 cpu_startup_entry+0x2a/0x30 rest_init+0xd0/0xd0 arch_call_rest_init+0xe/0x30 start_kernel+0x709/0xa90 x86_64_start_reservations+0x18/0x30 x86_64_start_kernel+0x96/0xa0 secondary_startup_64_no_verify+0x18f/0x19b ---[ end trace 0000000000000000 ]---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-rt-develUpgrade perfUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade bpftoolUpgrade kernel-develUpgrade kernel-zfcpdumpUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-rt-modules-extraUpgrade kernel-headersUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-cross-headersUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-rt-coreUpgrade kernelUpgrade kernel-rt-debug-modulesUpgrade python3-perfUpgrade kernel-modules | May 22, 2025 | Jul 12, 2024 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 18, 2024 | Jul 12, 2024 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Feb 10, 2025 | Jul 12, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Dec 5, 2024 | Jul 12, 2024 |
| Rocky_linux | — | Upgrade kernel-modulesUpgrade kernel-debug-coreUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-rt-debug-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-rt-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernelUpgrade kernel-rt-kvmUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-cross-headersUpgrade kernel-debug-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-debuginfoUpgrade kernel-rt-develUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-kvmUpgrade perf-debuginfoUpgrade perfUpgrade kernel-headersUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade python3-perfUpgrade kernel-devel | Jul 31, 2025 | Jul 29, 2025 |
| Suse | — | Upgrade kernel-rt-vdsoUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade dtb-broadcomUpgrade kernel-rt-extraUpgrade kernel-sourceUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade dtb-exynosUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade kernel-debug-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-develUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-extraUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-obs-buildUpgrade kernel-rt-optionalUpgrade kernel-azure-vdsoUpgrade dtb-caviumUpgrade kernel-azure-optionalUpgrade kernel-azure-livepatch-develUpgrade dtb-rockchipUpgrade kernel-default-livepatchUpgrade dtb-amlogicUpgrade kernel-docsUpgrade kernel-azureUpgrade kernel-rt_debug-develUpgrade kernel-source-vanillaUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-64kbUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade dtb-marvellUpgrade reiserfs-kmp-rtUpgrade dtb-appleUpgrade dtb-amdUpgrade gfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-default-optionalUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-default-develUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade dtb-lgUpgrade dtb-socionextUpgrade dtb-armUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-64kbUpgrade kernel-rt-develUpgrade dtb-xilinxUpgrade dtb-mediatekUpgrade dtb-apmUpgrade kernel-rt_debugUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-develUpgrade kernel-64kb-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dtb-allwinnerUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade kernel-symsUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-renesasUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-macrosUpgrade gfs2-kmp-64kbUpgrade dtb-freescaleUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade dlm-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade dtb-amazonUpgrade kernel-default-livepatch-develUpgrade kernel-64kb | Aug 8, 2024 | Jul 12, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1014-azureUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-oem-22.04aUpgrade linux-image-genericUpgrade linux-image-virtualUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-ibmUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-gcpUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-azureUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-gkeUpgrade linux-image-raspiUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-aws | Sep 12, 2024 | Jul 12, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub