In the Linux kernel, the following vulnerability has been resolved:
net/smc: Fix possible access to freed memory in link clear
After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that accessing the freed memory in tasklet context.
Here is a crash example:
BUG: unable to handle page fault for address: ffffffff8f220860 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23 Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> _raw_spin_lock_irqsave+0x30/0x40 mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20 </IRQ> do_softirq_own_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+0x34/0x80 asm_sysvec_call_function_single+0x12/0x20
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade dlm-kmp-azureUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-rt-vdsoUpgrade dtb-hisiliconUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-rtUpgrade dtb-socionextUpgrade kernel-rt_debugUpgrade dtb-marvellUpgrade kernel-64kb-extraUpgrade dtb-amazonUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade dtb-broadcomUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-optionalUpgrade kernel-default-livepatchUpgrade kernel-debugUpgrade kernel-debug-develUpgrade dtb-freescaleUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-amdUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-azure-extraUpgrade kernel-rt_debug-develUpgrade dtb-sprdUpgrade kernel-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-zfcpdumpUpgrade dtb-amlogicUpgrade kernel-source-vanillaUpgrade kernel-macrosUpgrade dtb-apmUpgrade kernel-debug-livepatch-develUpgrade kernel-docsUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade kernel-syms-rtUpgrade kernel-source-rtUpgrade kernel-default-extraUpgrade dtb-exynosUpgrade kernel-rt-livepatchUpgrade kernel-source-azureUpgrade kernel-devel-rtUpgrade gfs2-kmp-azureUpgrade dlm-kmp-64kbUpgrade kernel-devel-azureUpgrade gfs2-kmp-defaultUpgrade kernel-sourceUpgrade dtb-armUpgrade kernel-64kb-develUpgrade kernel-default-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-symsUpgrade cluster-md-kmp-azureUpgrade dtb-allwinnerUpgrade reiserfs-kmp-azureUpgrade kernel-default-optionalUpgrade dtb-caviumUpgrade kernel-develUpgrade gfs2-kmp-rtUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade kernel-preemptUpgrade dtb-qcomUpgrade kernel-rt-develUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade dtb-xilinxUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade dtb-lgUpgrade kernel-azure-develUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade kernel-preempt-develUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-optionalUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmall-develUpgrade dtb-mediatekUpgrade cluster-md-kmp-rtUpgrade kernel-syms-azure | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub