In the Linux kernel, the following vulnerability has been resolved:
net/smc: Fix possible access to freed memory in link clear
After modifying the QP to the Error state, all RX WR would be completed with WC in IB_WC_WR_FLUSH_ERR status. Current implementation does not wait for it is done, but destroy the QP and free the link group directly. So there is a risk that accessing the freed memory in tasklet context.
Here is a crash example:
BUG: unable to handle page fault for address: ffffffff8f220860 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD f7300e067 P4D f7300e067 PUD f7300f063 PMD 8c4e45063 PTE 800ffff08c9df060 Oops: 0002 [#1] SMP PTI CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: G S OE 5.10.0-0607+ #23 Hardware name: Inspur NF5280M4/YZMB-00689-101, BIOS 4.1.20 07/09/2018 RIP: 0010:native_queued_spin_lock_slowpath+0x176/0x1b0 Code: f3 90 48 8b 32 48 85 f6 74 f6 eb d5 c1 ee 12 83 e0 03 83 ee 01 48 c1 e0 05 48 63 f6 48 05 00 c8 02 00 48 03 04 f5 00 09 98 8e <48> 89 10 8b 42 08 85 c0 75 09 f3 90 8b 42 08 85 c0 74 f7 48 8b 32 RSP: 0018:ffffb3b6c001ebd8 EFLAGS: 00010086 RAX: ffffffff8f220860 RBX: 0000000000000246 RCX: 0000000000080000 RDX: ffff91db1f86c800 RSI: 000000000000173c RDI: ffff91db62bace00 RBP: ffff91db62bacc00 R08: 0000000000000000 R09: c00000010000028b R10: 0000000000055198 R11: ffffb3b6c001ea58 R12: ffff91db80e05010 R13: 000000000000000a R14: 0000000000000006 R15: 0000000000000040 FS: 0000000000000000(0000) GS:ffff91db1f840000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8f220860 CR3: 00000001f9580004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> _raw_spin_lock_irqsave+0x30/0x40 mlx5_ib_poll_cq+0x4c/0xc50 [mlx5_ib] smc_wr_rx_tasklet_fn+0x56/0xa0 [smc] tasklet_action_common.isra.21+0x66/0x100 __do_softirq+0xd5/0x29c asm_call_irq_on_stack+0x12/0x20 </IRQ> do_softirq_own_stack+0x37/0x40 irq_exit_rcu+0x9d/0xa0 sysvec_call_function_single+0x34/0x80 asm_sysvec_call_function_single+0x12/0x20
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade kernel-debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatchUpgrade reiserfs-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-develUpgrade kernel-default-develUpgrade dtb-amlogicUpgrade kernel-default-extraUpgrade kernel-docsUpgrade dtb-amazonUpgrade kernel-source-rtUpgrade kernel-default-baseUpgrade kernel-debugUpgrade kernel-rt-vdsoUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-64kbUpgrade kernel-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade dtb-freescaleUpgrade kernel-rt-livepatch-develUpgrade dtb-socionextUpgrade kernel-azureUpgrade kernel-rt_debug-develUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-azureUpgrade dtb-appleUpgrade ocfs2-kmp-rtUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-rt-optionalUpgrade dtb-hisiliconUpgrade kernel-zfcpdumpUpgrade kernel-source-vanillaUpgrade dtb-apmUpgrade kernel-rt_debug-vdsoUpgrade kernel-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-obs-qaUpgrade kselftests-kmp-rtUpgrade dtb-broadcomUpgrade kernel-64kb-livepatch-develUpgrade dtb-marvellUpgrade dtb-renesasUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-azureUpgrade kernel-macrosUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-64kbUpgrade dtb-exynosUpgrade kernel-devel-azureUpgrade dtb-alteraUpgrade kernel-kvmsmallUpgrade dtb-xilinxUpgrade kernel-rt-develUpgrade kernel-rtUpgrade kernel-preempt-develUpgrade kernel-syms-azureUpgrade kernel-sourceUpgrade kernel-rt-livepatchUpgrade kernel-rt-extraUpgrade kernel-preemptUpgrade kernel-obs-buildUpgrade kernel-azure-develUpgrade dtb-lgUpgrade dtb-qcomUpgrade kernel-default-optionalUpgrade gfs2-kmp-azureUpgrade dtb-caviumUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-source-azureUpgrade kernel-devel-rtUpgrade dtb-allwinnerUpgrade cluster-md-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade gfs2-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-azureUpgrade dtb-armUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade dtb-mediatek | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | May 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub