In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix implicit ODP use after free
Prevent double queueing of implicit ODP mr destroy work by using __xa_cmpxchg() to make sure this is the only time we are destroying this specific mr.
Without this change, we could try to invalidate this mr twice, which in turn could result in queuing a MR work destroy twice, and eventually the second work could execute after the MR was freed due to the first work, causing a user after free and trace below.
refcount_t: underflow; use-after-free. WARNING: CPU: 2 PID: 12178 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x130 Modules linked in: bonding ib_ipoib vfio_pci ip_gre geneve nf_tables ip6_gre gre ip6_tunnel tunnel6 ipip tunnel4 ib_umad rdma_ucm mlx5_vfio_pci vfio_pci_core vfio_iommu_type1 mlx5_ib vfio ib_uverbs mlx5_core iptable_raw openvswitch nsh rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay zram zsmalloc fuse [last unloaded: ib_uverbs] CPU: 2 PID: 12178 Comm: kworker/u20:5 Not tainted 6.5.0-rc1_net_next_mlx5_58c644e #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: events_unbound free_implicit_child_mr_work [mlx5_ib] RIP: 0010:refcount_warn_saturate+0x12b/0x130 Code: 48 c7 c7 38 95 2a 82 c6 05 bc c6 fe 00 01 e8 0c 66 aa ff 0f 0b 5b c3 48 c7 c7 e0 94 2a 82 c6 05 a7 c6 fe 00 01 e8 f5 65 aa ff <0f> 0b 5b c3 90 8b 07 3d 00 00 00 c0 74 12 83 f8 01 74 13 8d 50 ff RSP: 0018:ffff8881008e3e40 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027 RDX: ffff88852c91b5c8 RSI: 0000000000000001 RDI: ffff88852c91b5c0 RBP: ffff8881dacd4e00 R08: 00000000ffffffff R09: 0000000000000019 R10: 000000000000072e R11: 0000000063666572 R12: ffff88812bfd9e00 R13: ffff8881c792d200 R14: ffff88810011c005 R15: ffff8881002099c0 FS: 0000000000000000(0000) GS:ffff88852c900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5694b5e000 CR3: 00000001153f6003 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? refcount_warn_saturate+0x12b/0x130 free_implicit_child_mr_work+0x180/0x1b0 [mlx5_ib] process_one_work+0x1cc/0x3c0 worker_thread+0x218/0x3c0 kthread+0xc6/0xf0 ret_from_fork+0x1f/0x30 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-modulesUpgrade kernel-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-coreUpgrade kernel-devel-matchedUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debugUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade libperfUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-rt-debug-coreUpgrade kernel-modules-coreUpgrade kernel-debug-uki-virtUpgrade kernel-headersUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debugUpgrade kernel-cross-headersUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-tools-libsUpgrade kernel-rt-64k-modulesUpgrade kernel-64kUpgrade kernel-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-64k-develUpgrade kernel-64k-debug-coreUpgrade kernelUpgrade kernel-64k-coreUpgrade kernel-develUpgrade kernel-coreUpgrade kernel-64k-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade rtlaUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-rt-modules-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-rt-64k-debug-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64kUpgrade kernel-64k-modules-extraUpgrade kernel-rt-64k-develUpgrade kernel-rt-64k-debug-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rtUpgrade kernel-rt-64k-modules-extraUpgrade kernel-docUpgrade kernel-rt-modulesUpgrade kernel-rt-64k-coreUpgrade kernel-debug-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-64k-debug-modules-extraUpgrade kernel-debug-devel-matchedUpgrade perfUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-64k-debugUpgrade kernel-rt-develUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade rv | Nov 20, 2025 | Nov 11, 2025 |
| Debian | — | Upgrade linuxNo solution exists | May 15, 2025 | Feb 27, 2025 |
| Oracle_linux | — | Upgrade kernel | Nov 28, 2025 | Feb 27, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 9, 2025 | Feb 27, 2025 |
| Rocky_linux | — | Upgrade kernel-rt-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-toolsUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernelUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-develUpgrade kernel-rt-develUpgrade kernel-tools-debuginfoUpgrade rvUpgrade kernel-zfcpdump-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modules-coreUpgrade kernel-rtUpgrade kernel-debug-uki-virtUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debugUpgrade kernel-devel-matchedUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-modules-coreUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-coreUpgrade kernel-zfcpdump-develUpgrade kernel-modulesUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-rt-debuginfoUpgrade kernel-debugUpgrade kernel-debuginfoUpgrade libperf-debuginfoUpgrade kernel-rt-debug-develUpgrade rtlaUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-zfcpdumpUpgrade libperfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-uki-virtUpgrade kernel-tools-libs-devel | Feb 5, 2026 | Nov 21, 2025 |
| Suse | — | Upgrade dtb-armUpgrade kernel-default-optionalUpgrade kernel-rt-optionalUpgrade dtb-nvidiaUpgrade dtb-allwinnerUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-develUpgrade dtb-socionextUpgrade reiserfs-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade dtb-rockchipUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade kernel-default-baseUpgrade kernel-azureUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-azureUpgrade kernel-defaultUpgrade dtb-amdUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade dtb-renesasUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade gfs2-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-source-rtUpgrade kernel-rt_debugUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-docsUpgrade kernel-develUpgrade kernel-debug-vdsoUpgrade kernel-rt-vdsoUpgrade dtb-alteraUpgrade dtb-amazonUpgrade kernel-rt-develUpgrade kernel-azure-develUpgrade kernel-azure-vdsoUpgrade dtb-hisiliconUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade ocfs2-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-azure-extraUpgrade dtb-lgUpgrade dtb-freescaleUpgrade dtb-appleUpgrade kernel-default-vdsoUpgrade kernel-obs-qaUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-livepatchUpgrade dtb-marvellUpgrade dtb-exynosUpgrade kernel-debugUpgrade dtb-qcomUpgrade dtb-broadcomUpgrade dtb-amlogicUpgrade kernel-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-debug-develUpgrade dlm-kmp-azureUpgrade dtb-xilinxUpgrade kernel-symsUpgrade cluster-md-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade dtb-mediatekUpgrade kernel-macrosUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-64kbUpgrade dtb-apmUpgrade dlm-kmp-64kbUpgrade kernel-rtUpgrade kernel-default-extraUpgrade kernel-azure-optionalUpgrade kernel-64kb-develUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade kernel-syms-rt | Apr 9, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1031-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-2026-raspi-realtimeUpgrade linux-image-6.8.0-1031-raspiUpgrade linux-image-genericUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1031-nvidia-lowlatencyUpgrade linux-image-6.8.0-1029-oracle-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-6.8.0-64-lowlatency-64kUpgrade linux-image-realtimeUpgrade linux-image-6.8.0-1033-gcp-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1015-gkeopUpgrade linux-image-azureUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-raspi-6.8Upgrade linux-image-gkeopUpgrade linux-image-gkeUpgrade linux-image-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-aws-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1031-oemUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-raspiUpgrade linux-image-nvidia-6.8Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1032-aws-64kUpgrade linux-image-azure-fde-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-azure-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-64-genericUpgrade linux-image-6.8.0-1028-gkeUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1029-oracleUpgrade linux-image-oracle-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-azure-nvidia-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-64-lowlatencyUpgrade linux-image-generic-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1031-nvidiaUpgrade linux-image-6.8.0-1029-ibmUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-azure-fdeUpgrade linux-image-oem-6.8Upgrade linux-image-6.8.0-1034-azure-fdeUpgrade linux-image-generic-64k-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1033-gcpUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-64-generic-64kUpgrade linux-image-6.8.0-1022-azure-nvidiaUpgrade linux-image-kvmUpgrade linux-image-azure-nvidia-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.1-1025-realtimeUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1034-azureUpgrade linux-image-6.8.0-1032-awsUpgrade linux-image-6.8.0-1031-nvidia-64kUpgrade linux-image-lowlatencyUpgrade linux-image-raspi-realtimeUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-24.04aUpgrade linux-image-ibm-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-virtualUpgrade linux-image-azure-fde-lts-24.04 | Jun 26, 2025 | Feb 27, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Feb 27, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub