In the Linux kernel, the following vulnerability has been resolved:
vdpa/mlx5: Fix invalid mr resource destroy
Certain error paths from mlx5_vdpa_dev_add() can end up releasing mr resources which never got initialized in the first place.
This patch adds the missing check in mlx5_vdpa_destroy_mr_resources() to block releasing non-initialized mr resources.
Reference trace:
mlx5_core 0000:08:00.2: mlx5_vdpa_dev_add:3274:(pid 2700) warning: No mac address provisioned? BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 140216067 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 8 PID: 2700 Comm: vdpa Kdump: loaded Not tainted 5.14.0-496.el9.x86_64 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] Code: [...] RSP: 0018:ff1c823ac23077f0 EFLAGS: 00010246 RAX: ffffffffc1a21a60 RBX: ffffffff899567a0 RCX: 0000000000000000 RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000000000000000 RBP: ff1bda1f7c21e800 R08: 0000000000000000 R09: ff1c823ac2307670 R10: ff1c823ac2307668 R11: ffffffff8a9e7b68 R12: 0000000000000000 R13: 0000000000000000 R14: ff1bda1f43e341a0 R15: 00000000ffffffea FS: 00007f56eba7c740(0000) GS:ff1bda269f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000104d90001 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace:
? show_trace_log_lvl+0x1c4/0x2df ? show_trace_log_lvl+0x1c4/0x2df ? mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] ? __die_body.cold+0x8/0xd ? page_fault_oops+0x134/0x170 ? __irq_work_queue_local+0x2b/0xc0 ? irq_work_queue+0x2c/0x50 ? exc_page_fault+0x62/0x150 ? asm_exc_page_fault+0x22/0x30 ? __pfx_mlx5_vdpa_free+0x10/0x10 [mlx5_vdpa] ? vhost_iotlb_del_range+0xf/0xe0 [vhost_iotlb] mlx5_vdpa_free+0x3d/0x150 [mlx5_vdpa] vdpa_release_dev+0x1e/0x50 [vdpa] device_release+0x31/0x90 kobject_cleanup+0x37/0x130 mlx5_vdpa_dev_add+0x2d2/0x7a0 [mlx5_vdpa] vdpa_nl_cmd_dev_add_set_doit+0x277/0x4c0 [vdpa] genl_family_rcv_msg_doit+0xd9/0x130 genl_family_rcv_msg+0x14d/0x220 ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa] ? _copy_to_user+0x1a/0x30 ? move_addr_to_user+0x4b/0xe0 genl_rcv_msg+0x47/0xa0 ? __import_iovec+0x46/0x150 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x245/0x370 netlink_sendmsg+0x206/0x440 __sys_sendto+0x1dc/0x1f0 ? do_read_fault+0x10c/0x1d0 ? do_pte_missing+0x10d/0x190 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x5c/0xf0 ? __count_memcg_events+0x4f/0xb0 ? mm_account_fault+0x6c/0x100 ? handle_mm_fault+0x116/0x270 ? do_user_addr_fault+0x1d6/0x6a0 ? do_syscall_64+0x6b/0xf0 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 ? clear_bhb_loop+0x25/0x80 entry_SYSCALL_64_after_hwframe+0x78/0x80
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Mar 12, 2025 | Oct 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | May 15, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-azure-fdeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1022-nvidia-lowlatencyUpgrade linux-image-6.8.0-54-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1024-gcpUpgrade linux-image-awsUpgrade linux-image-6.8.0-1022-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-64kUpgrade linux-image-oem-24.04bUpgrade linux-image-6.11.0-1009-awsUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1022-nvidia-64kUpgrade linux-image-6.8.0-1022-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1019-gkeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1025-azureUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-6.8.0-54-generic-64kUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1023-awsUpgrade linux-image-6.8.0-54-lowlatency-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1019-raspiUpgrade linux-image-genericUpgrade linux-image-6.8.0-1006-gkeopUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-6.8.0-54-genericUpgrade linux-image-generic-64kUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-gkeUpgrade linux-image-gkeopUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1020-oracleUpgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-ibmUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-6.8.0-57-genericUpgrade linux-image-6.8.0-1020-oracle-64kUpgrade linux-image-6.11.0-1015-oemUpgrade linux-image-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-virtualUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-azureUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1024-oemUpgrade linux-image-6.11.0-1009-azureUpgrade linux-image-6.8.0-1024-gcp-64k | Feb 20, 2025 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub