In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when __mlx5_ib_add() does its cleanup.
Resolves a splat:
Syzkaller reported a UAF in ib_destroy_qp_user
workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642
Call Trace: <TASK> kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK>
Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-obs-qaUpgrade kernel-64kb-livepatch-develUpgrade kernel-develUpgrade kernel-default-develUpgrade dtb-allwinnerUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-64kbUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-default-base-rebuildUpgrade dtb-broadcomUpgrade kernel-default-livepatchUpgrade kernel-default-vdsoUpgrade kernel-debugUpgrade dtb-amlogicUpgrade kernel-kvmsmall-develUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade dtb-apmUpgrade kernel-devel-azureUpgrade dtb-alteraUpgrade kernel-rt-livepatchUpgrade kernel-symsUpgrade kernel-source-azureUpgrade kernel-rtUpgrade gfs2-kmp-64kbUpgrade kernel-default-optionalUpgrade kernel-rt_debug-develUpgrade kernel-sourceUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-optionalUpgrade dtb-exynosUpgrade ocfs2-kmp-defaultUpgrade dtb-caviumUpgrade kernel-kvmsmallUpgrade kselftests-kmp-azureUpgrade dtb-amazonUpgrade kernel-azure-optionalUpgrade kernel-azure-develUpgrade kernel-rt-optionalUpgrade dtb-xilinxUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-zfcpdumpUpgrade dtb-qcomUpgrade ocfs2-kmp-rtUpgrade kernel-azure-extraUpgrade dtb-lgUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-default-extraUpgrade kernel-syms-azureUpgrade kernel-macrosUpgrade kselftests-kmp-64kbUpgrade kernel-source-rtUpgrade reiserfs-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-debug-develUpgrade dtb-sprdUpgrade kselftests-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-devel-rtUpgrade dlm-kmp-defaultUpgrade dtb-socionextUpgrade dtb-amdUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade kselftests-kmp-rtUpgrade dtb-nvidiaUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-rt-develUpgrade dlm-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade dtb-rockchipUpgrade dtb-marvellUpgrade kernel-rt-extraUpgrade kernel-64kb-extraUpgrade dtb-armUpgrade kernel-syms-rtUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade kernel-defaultUpgrade dtb-appleUpgrade dlm-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-azure-vdsoUpgrade dtb-renesasUpgrade kernel-debug-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade gfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-mediatek | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-6.5 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 21, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub