In the Linux kernel, the following vulnerability has been resolved:
net/smc: Fix possible access to freed memory in link clear
After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that accessing the freed memory in tasklet context.
Here is a crash example:
BUG: unable to handle page fault for address: ffffffff8f220860 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23 Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> _raw_spin_lock_irqsave+0x30/0x40 mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20 </IRQ> do_softirq_own_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+0x34/0x80 asm_sysvec_call_function_single+0x12/0x20
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade dtb-amazonUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-default-baseUpgrade dtb-freescaleUpgrade dlm-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-source-vanillaUpgrade kselftests-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-64kbUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade kernel-debug-develUpgrade dlm-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade gfs2-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-defaultUpgrade dtb-socionextUpgrade kernel-azure-vdsoUpgrade kernel-obs-qaUpgrade kselftests-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-64kb-livepatch-develUpgrade dlm-kmp-azureUpgrade dtb-renesasUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-broadcomUpgrade kernel-default-develUpgrade kernel-debugUpgrade kernel-rt_debugUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-optionalUpgrade kselftests-kmp-rtUpgrade kernel-macrosUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-extraUpgrade dtb-hisiliconUpgrade dtb-appleUpgrade dtb-sprdUpgrade kernel-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-marvellUpgrade kernel-azure-livepatch-develUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade kernel-preemptUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade kernel-preempt-develUpgrade ocfs2-kmp-azureUpgrade dtb-mediatekUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-develUpgrade gfs2-kmp-defaultUpgrade dtb-nvidiaUpgrade kernel-64kb-develUpgrade kernel-kvmsmallUpgrade dtb-lgUpgrade kernel-azure-develUpgrade reiserfs-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-source-azureUpgrade kernel-default-optionalUpgrade dtb-caviumUpgrade dtb-allwinnerUpgrade cluster-md-kmp-azureUpgrade kernel-symsUpgrade gfs2-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-rt-livepatchUpgrade kernel-sourceUpgrade kernel-syms-azureUpgrade kernel-devel-azureUpgrade dtb-exynosUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-armUpgrade kernel-develUpgrade dtb-alteraUpgrade kernel-azure-optionalUpgrade kernel-default-base-rebuildUpgrade kernel-obs-buildUpgrade dtb-xilinxUpgrade kernel-rt | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 3, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub