In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when __mlx5_ib_add() does its cleanup.
Resolves a splat:
Syzkaller reported a UAF in ib_destroy_qp_user
workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642
Call Trace: <TASK> kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK>
Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-docs-htmlUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-defaultUpgrade dtb-caviumUpgrade gfs2-kmp-64kbUpgrade dtb-amazonUpgrade kernel-default-develUpgrade dtb-exynosUpgrade dlm-kmp-64kbUpgrade dtb-lgUpgrade dtb-xilinxUpgrade kernel-64kbUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-develUpgrade kernel-obs-qaUpgrade kernel-rt-livepatchUpgrade kernel-rt_debug-develUpgrade dtb-qcomUpgrade kernel-azure-extraUpgrade kernel-source-rtUpgrade kernel-macrosUpgrade cluster-md-kmp-rtUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmallUpgrade dtb-freescaleUpgrade kernel-symsUpgrade dtb-apmUpgrade dtb-alteraUpgrade kernel-source-azureUpgrade dtb-allwinnerUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-develUpgrade dtb-hisiliconUpgrade dtb-broadcomUpgrade kernel-default-base-rebuildUpgrade dtb-amlogicUpgrade kernel-64kb-optionalUpgrade kernel-rtUpgrade cluster-md-kmp-azureUpgrade kernel-sourceUpgrade kernel-azure-livepatch-develUpgrade kernel-default-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-default-extraUpgrade ocfs2-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-azure-develUpgrade kernel-debugUpgrade kselftests-kmp-azureUpgrade kernel-devel-azureUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-buildUpgrade dtb-armUpgrade kernel-devel-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt_debugUpgrade kernel-rt-develUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-azureUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-rt-extraUpgrade dtb-marvellUpgrade kernel-rt-livepatch-develUpgrade kernel-64kb-extraUpgrade dtb-rockchipUpgrade dtb-appleUpgrade dlm-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade dtb-renesasUpgrade dtb-nvidiaUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade cluster-md-kmp-64kbUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade kernel-debug-vdsoUpgrade dtb-amdUpgrade kernel-syms-rtUpgrade kernel-docsUpgrade kernel-debug-develUpgrade dtb-sprdUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-defaultUpgrade dtb-mediatek | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-6.5 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub