In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Wrap the tx reporter dump callback to extract the sq
Function mlx5e_tx_reporter_dump_sq() casts its void * argument to struct mlx5e_txqsq *, but in TX-timeout-recovery flow the argument is actually of type struct mlx5e_tx_timeout_ctx *.
mlx5_core 0000:08:00.1 enp8s0f1: TX timeout detected mlx5_core 0000:08:00.1 enp8s0f1: TX timeout on queue: 1, SQ: 0x11ec, CQ: 0x146d, SQ Cons: 0x0 SQ Prod: 0x1, usecs since last trans: 21565000 BUG: stack guard page was hit at 0000000093f1a2de (stack is 00000000b66ea0dc..000000004d932dae) kernel stack overflow (page fault): 0000 [#1] SMP NOPTI CPU: 5 PID: 95 Comm: kworker/u20:1 Tainted: G W OE 5.13.0_mlnx #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5e mlx5e_tx_timeout_work [mlx5_core] RIP: 0010:mlx5e_tx_reporter_dump_sq+0xd3/0x180 [mlx5_core] Call Trace: mlx5e_tx_reporter_dump+0x43/0x1c0 [mlx5_core] devlink_health_do_dump.part.91+0x71/0xd0 devlink_health_report+0x157/0x1b0 mlx5e_reporter_tx_timeout+0xb9/0xf0 [mlx5_core] ? mlx5e_tx_reporter_err_cqe_recover+0x1d0/0x1d0 [mlx5_core] ? mlx5e_health_queue_dump+0xd0/0xd0 [mlx5_core] ? update_load_avg+0x19b/0x550 ? set_next_entity+0x72/0x80 ? pick_next_task_fair+0x227/0x340 ? finish_task_switch+0xa2/0x280 mlx5e_tx_timeout_work+0x83/0xb0 [mlx5_core] process_one_work+0x1de/0x3a0 worker_thread+0x2d/0x3c0 ? process_one_work+0x3a0/0x3a0 kthread+0x115/0x130 ? kthread_park+0x90/0x90 ret_from_fork+0x1f/0x30 --[ end trace 51ccabea504edaff ]--- RIP: 0010:mlx5e_tx_reporter_dump_sq+0xd3/0x180 PKRU: 55555554 Kernel panic - not syncing: Fatal exception Kernel Offset: disabled end Kernel panic - not syncing: Fatal exception
To fix this bug add a wrapper for mlx5e_tx_reporter_dump_sq() which extracts the sq from struct mlx5e_tx_timeout_ctx and set it as the TX-timeout-recovery flow dump callback.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perfUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-5.10.93-87.444 | Apr 26, 2024 | Feb 27, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 27, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2024 |
| Suse | — | Upgrade kernel-rt-livepatchUpgrade dtb-armUpgrade cluster-md-kmp-64kbUpgrade kernel-docsUpgrade kernel-default-livepatchUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-azure-extraUpgrade kernel-64kb-extraUpgrade dtb-amdUpgrade kernel-default-baseUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade dtb-freescaleUpgrade kernel-develUpgrade kernel-azure-optionalUpgrade dtb-sprdUpgrade kernel-rt_debugUpgrade gfs2-kmp-defaultUpgrade kernel-devel-rtUpgrade dtb-appleUpgrade dtb-broadcomUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade dtb-allwinnerUpgrade kernel-default-optionalUpgrade kernel-debugUpgrade dtb-mediatekUpgrade kernel-defaultUpgrade kernel-debug-develUpgrade dtb-nvidiaUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade kernel-source-vanillaUpgrade dtb-marvellUpgrade ocfs2-kmp-azureUpgrade dtb-socionextUpgrade kernel-64kb-optionalUpgrade kernel-symsUpgrade kernel-rt_debug-develUpgrade dtb-xilinxUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade kernel-preempt-develUpgrade kernel-rt-develUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-sourceUpgrade kernel-default-extraUpgrade gfs2-kmp-rtUpgrade kernel-source-azureUpgrade kernel-syms-rtUpgrade dtb-apmUpgrade kernel-source-rtUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-preemptUpgrade kernel-syms-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-azureUpgrade kernel-obs-buildUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-extraUpgrade kernel-default-vdsoUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-azure-develUpgrade dlm-kmp-azureUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-debug-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade dtb-exynosUpgrade kernel-macrosUpgrade kernel-64kb-livepatch-develUpgrade kernel-obs-qaUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-azureUpgrade kernel-64kbUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-qcomUpgrade dtb-rockchipUpgrade kernel-rt-vdsoUpgrade kernel-azure-vdso | Aug 9, 2024 | Feb 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub