In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when __mlx5_ib_add() does its cleanup.
Resolves a splat:
Syzkaller reported a UAF in ib_destroy_qp_user
workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642
Call Trace: <TASK> kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK>
Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kselftests-kmp-64kbUpgrade kernel-64kbUpgrade kernel-default-vdsoUpgrade kernel-macrosUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-develUpgrade cluster-md-kmp-rtUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade kernel-debugUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-caviumUpgrade dtb-broadcomUpgrade dtb-allwinnerUpgrade kernel-azure-develUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-syms-azureUpgrade dtb-apmUpgrade kernel-symsUpgrade kernel-docs-htmlUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-freescaleUpgrade kernel-kvmsmall-develUpgrade dtb-lgUpgrade kernel-rt-optionalUpgrade gfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade dtb-hisiliconUpgrade dtb-alteraUpgrade kernel-obs-qaUpgrade kernel-azure-optionalUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade kernel-azure-livepatch-develUpgrade dtb-qcomUpgrade dtb-amlogicUpgrade kernel-kvmsmallUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade kernel-default-optionalUpgrade kernel-default-extraUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade kernel-docsUpgrade dtb-sprdUpgrade reiserfs-kmp-defaultUpgrade dtb-mediatekUpgrade kernel-debug-livepatch-develUpgrade dtb-renesasUpgrade kernel-azure-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade dtb-nvidiaUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-develUpgrade dlm-kmp-rtUpgrade kernel-debug-vdsoUpgrade dtb-rockchipUpgrade kselftests-kmp-rtUpgrade kernel-rt-vdsoUpgrade dlm-kmp-azureUpgrade kernel-defaultUpgrade dtb-appleUpgrade reiserfs-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade kernel-azureUpgrade kselftests-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-devel-rtUpgrade kernel-rt-extraUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-rt-develUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade dtb-socionextUpgrade cluster-md-kmp-64kbUpgrade dtb-amdUpgrade dlm-kmp-defaultUpgrade dtb-marvellUpgrade dtb-armUpgrade kernel-syms-rt | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-6.5 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub