In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix page_size variable overflow
Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow.
For example: If we try to register 4GB of memory that is contiguous in physical memory, the driver will optimize the page_size and try to use an mkey with 4GB entity size. The 'unsigned int' page_size variable will overflow to '0' and we'll hit the WARN_ON() in alloc_cacheable_mr().
WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Modules linked in: mlx5_ib mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_rxe rdma_ucm ib_uverbs ib_ipoib ib_umad rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm fuse ib_core [last unloaded: mlx5_core] CPU: 2 UID: 70878 PID: 1203 Comm: rdma_resource_l Tainted: G W 6.14.0-rc4-dirty #43 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41 RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246 RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001 RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600 RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240 R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00 FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x81/0x130 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] ? report_bug+0xfc/0x1e0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] create_real_mr+0x54/0x150 [mlx5_ib] ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xca/0x140 [ib_uverbs] ib_uverbs_run_method+0x6d0/0x780 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x19b/0x360 [ib_uverbs] ? walk_system_ram_range+0x79/0xd0 ? ___pte_offset_map+0x1b/0x110 ? __pte_offset_map_lock+0x80/0x100 ib_uverbs_ioctl+0xac/0x110 [ib_uverbs] __x64_sys_ioctl+0x94/0xb0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb7ecf0737b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4 R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150 </TASK>
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rvUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-debug-uki-virtUpgrade kernel-rt-64k-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-develUpgrade kernel-debug-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-debug-modules-extraUpgrade kernel-uki-virtUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-develUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-kvmUpgrade rtlaUpgrade kernel-rt-64kUpgrade kernel-64k-modules-coreUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-toolsUpgrade kernel-debug-develUpgrade kernel-rt-debug-coreUpgrade kernel-64k-debug-develUpgrade kernel-coreUpgrade kernel-docUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-rt-64k-coreUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-develUpgrade kernel-rt-64k-debugUpgrade kernel-cross-headersUpgrade kernel-rt-64k-modules-coreUpgrade libperfUpgrade kernel-debug-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-64k-debug-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-64kUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-64k-debugUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-kvmUpgrade kernel-64k-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernelUpgrade kernel-64k-debug-modules-extraUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade kernel-debug-modules-coreUpgrade kernel-modulesUpgrade kernel-rt-64k-debug-core | Aug 4, 2025 | Jul 28, 2025 |
| Amazon_linux_2023 | — | Upgrade bpftoolUpgrade kernel-modules-extra-commonUpgrade perf6.12Upgrade kernel6.12Upgrade bpftool-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade kernel-toolsUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel6.12-modules-extraUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel-libbpf-develUpgrade python3-perf6.12-debuginfoUpgrade kernel-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-livepatch-6.12.23-29.97Upgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade python3-perf6.12 | Jun 24, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel | Jul 31, 2025 | Apr 16, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jul 9, 2025 | Apr 16, 2025 |
| Rocky_linux | — | Upgrade kernel-debug-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-debug-uki-virtUpgrade kernel-debugUpgrade kernel-uki-virtUpgrade kernel-modulesUpgrade kernel-modules-coreUpgrade kernel-rt-coreUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-cross-headersUpgrade python3-perfUpgrade kernel-debug-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debug-devel-matchedUpgrade libperfUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade rtlaUpgrade kernelUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rtUpgrade python3-perf-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-kvmUpgrade rvUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libsUpgrade perfUpgrade kernel-rt-debug-debuginfoUpgrade kernel-debug-modulesUpgrade libperf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-core | Feb 5, 2026 | Oct 4, 2025 |
| Suse | — | Upgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade kernel-azureUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-vanillaUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-azure-develUpgrade kernel-default-livepatchUpgrade kernel-azure-extraUpgrade kernel-azure-vdsoUpgrade kernel-default-vdsoUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-obs-qaUpgrade kernel-macrosUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-default-extraUpgrade kernel-symsUpgrade kernel-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade kernel-zfcpdumpUpgrade kernel-source-azureUpgrade kernel-syms-azureUpgrade kernel-develUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-default | Dec 5, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-genericUpgrade linux-image-aws-64kUpgrade linux-image-oracleUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-raspiUpgrade linux-image-gcpUpgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-awsUpgrade linux-image-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-azure | Jun 26, 2025 | Apr 16, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub