In the Linux kernel, the following vulnerability has been resolved:
net/smc: Fix possible access to freed memory in link clear
After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that accessing the freed memory in tasklet context.
Here is a crash example:
BUG: unable to handle page fault for address: ffffffff8f220860 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23 Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> _raw_spin_lock_irqsave+0x30/0x40 mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20 </IRQ> do_softirq_own_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+0x34/0x80 asm_sysvec_call_function_single+0x12/0x20
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-64kb-extraUpgrade dtb-marvellUpgrade dtb-apmUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-default-livepatch-develUpgrade kernel-rt_debugUpgrade dtb-hisiliconUpgrade kernel-macrosUpgrade kernel-debug-livepatch-develUpgrade kernel-source-rtUpgrade kernel-syms-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-default-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-docsUpgrade kernel-debug-vdsoUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-rt-optionalUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-vdsoUpgrade dtb-socionextUpgrade kselftests-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-default-develUpgrade kernel-debugUpgrade gfs2-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-debug-develUpgrade dtb-sprdUpgrade kernel-azureUpgrade dtb-appleUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-rt_debug-develUpgrade kernel-64kb-optionalUpgrade kernel-64kbUpgrade kernel-source-vanillaUpgrade kernel-zfcpdumpUpgrade kernel-default-baseUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-rtUpgrade dtb-broadcomUpgrade dlm-kmp-azureUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade reiserfs-kmp-64kbUpgrade dtb-amdUpgrade cluster-md-kmp-defaultUpgrade dtb-amazonUpgrade dtb-qcomUpgrade kselftests-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-rt-livepatchUpgrade dtb-exynosUpgrade dtb-alteraUpgrade kernel-azure-develUpgrade kernel-preemptUpgrade kernel-azure-livepatch-develUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade dtb-xilinxUpgrade kernel-rt-develUpgrade kernel-rt-extraUpgrade dtb-lgUpgrade kernel-develUpgrade dtb-armUpgrade gfs2-kmp-rtUpgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-mediatekUpgrade ocfs2-kmp-azureUpgrade dtb-caviumUpgrade gfs2-kmp-azureUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-source-azureUpgrade kernel-default-optionalUpgrade kernel-devel-rtUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade cluster-md-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-default-vdsoUpgrade kernel-preempt-develUpgrade dtb-nvidiaUpgrade cluster-md-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade kernel-devel-azureUpgrade kernel-source | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub