In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when __mlx5_ib_add() does its cleanup.
Resolves a splat:
Syzkaller reported a UAF in ib_destroy_qp_user
workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642
Call Trace: <TASK> kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK>
Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade dlm-kmp-64kbUpgrade dtb-qcomUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade dtb-amlogicUpgrade kselftests-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-rt-livepatchUpgrade kernel-symsUpgrade kernel-kvmsmall-develUpgrade kernel-debugUpgrade kernel-macrosUpgrade cluster-md-kmp-rtUpgrade kernel-default-extraUpgrade ocfs2-kmp-64kbUpgrade dtb-broadcomUpgrade dtb-amazonUpgrade kernel-azure-optionalUpgrade kernel-default-base-rebuildUpgrade kernel-syms-azureUpgrade kernel-64kb-develUpgrade kernel-rt_debug-develUpgrade kernel-default-livepatchUpgrade dtb-caviumUpgrade gfs2-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-rtUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-azure-develUpgrade kernel-azure-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-azure-extraUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-rtUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-apmUpgrade dtb-exynosUpgrade kernel-rt-optionalUpgrade dtb-freescaleUpgrade kernel-kvmsmallUpgrade dtb-alteraUpgrade gfs2-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-sourceUpgrade kernel-source-azureUpgrade kernel-default-vdsoUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade kernel-default-develUpgrade kernel-64kbUpgrade kernel-develUpgrade kernel-rt_debugUpgrade kernel-docsUpgrade dtb-sprdUpgrade kernel-debug-develUpgrade dtb-amdUpgrade kernel-debug-vdsoUpgrade kernel-source-vanillaUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade dlm-kmp-azureUpgrade dtb-appleUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-obs-buildUpgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-64kb-extraUpgrade dtb-rockchipUpgrade dtb-armUpgrade dlm-kmp-rtUpgrade dtb-marvellUpgrade dtb-socionextUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-rt-develUpgrade kernel-azureUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-defaultUpgrade dtb-renesasUpgrade dtb-nvidiaUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-syms-rtUpgrade reiserfs-kmp-default | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-6.5 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub