In the Linux kernel, the following vulnerability has been resolved:
IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF
In the unlikely event that workqueue allocation fails and returns NULL in mlx5_mkey_cache_init(), delete the call to mlx5r_umr_resource_cleanup() (which frees the QP) in mlx5_ib_stage_post_ib_reg_umr_init(). This will avoid attempted double free of the same QP when __mlx5_ib_add() does its cleanup.
Resolves a splat:
Syzkaller reported a UAF in ib_destroy_qp_user
workqueue: Failed to create a rescuer kthread for wq "mkey_cache": -EINTR infiniband mlx5_0: mlx5_mkey_cache_init:981:(pid 1642): failed to create work queue infiniband mlx5_0: mlx5_ib_stage_post_ib_reg_umr_init:4075:(pid 1642): mr cache init failed -12 ================================================================== BUG: KASAN: slab-use-after-free in ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) Read of size 8 at addr ffff88810da310a8 by task repro_upstream/1642
Call Trace: <TASK> kasan_report (mm/kasan/report.c:590) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2073) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4178) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ... </TASK>
Allocated by task 1642: __kmalloc (./include/linux/kasan.h:198 mm/slab_common.c:1026 mm/slab_common.c:1039) create_qp (./include/linux/slab.h:603 ./include/linux/slab.h:720 ./include/rdma/ib_verbs.h:2795 drivers/infiniband/core/verbs.c:1209) ib_create_qp_kernel (drivers/infiniband/core/verbs.c:1347) mlx5r_umr_resource_init (drivers/infiniband/hw/mlx5/umr.c:164) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4070) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
Freed by task 1642: __kmem_cache_free (mm/slub.c:1826 mm/slub.c:3809 mm/slub.c:3822) ib_destroy_qp_user (drivers/infiniband/core/verbs.c:2112) mlx5r_umr_resource_cleanup (drivers/infiniband/hw/mlx5/umr.c:198) mlx5_ib_stage_post_ib_reg_umr_init (drivers/infiniband/hw/mlx5/main.c:4076 drivers/infiniband/hw/mlx5/main.c:4065) __mlx5_ib_add (drivers/infiniband/hw/mlx5/main.c:4168) mlx5r_probe (drivers/infiniband/hw/mlx5/main.c:4402) ...
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-rt-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-rt-extraUpgrade dtb-armUpgrade kernel-debug-develUpgrade kselftests-kmp-rtUpgrade kernel-docsUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-syms-rtUpgrade dtb-marvellUpgrade dtb-sprdUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-default-baseUpgrade dlm-kmp-azureUpgrade dtb-appleUpgrade kernel-azureUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade kernel-rt_debugUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-vdsoUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-mediatekUpgrade kernel-azure-vdsoUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade dtb-rockchipUpgrade kselftests-kmp-defaultUpgrade kernel-obs-buildUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-apmUpgrade dtb-alteraUpgrade dtb-freescaleUpgrade dtb-caviumUpgrade kernel-docs-htmlUpgrade kernel-azure-optionalUpgrade dtb-amazonUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-macrosUpgrade kernel-default-extraUpgrade kernel-source-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-sourceUpgrade kernel-default-vdsoUpgrade gfs2-kmp-rtUpgrade kernel-obs-qaUpgrade kernel-default-develUpgrade kernel-64kb-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-azure-extraUpgrade dtb-xilinxUpgrade dtb-lgUpgrade kernel-develUpgrade kernel-azure-develUpgrade dlm-kmp-64kbUpgrade kernel-symsUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-64kbUpgrade kernel-rt-livepatchUpgrade dtb-qcomUpgrade dtb-exynosUpgrade cluster-md-kmp-azureUpgrade kernel-64kb-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-default-base-rebuildUpgrade dtb-hisiliconUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade kernel-debugUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kselftests-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-rtUpgrade kernel-default-optionalUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-defaultUpgrade kernel-syms-azureUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-64kb | Jun 13, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-6.5 | Nov 19, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub