In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix page_size variable overflow
Change all variables storing mlx5_umem_mkc_find_best_pgsz() result to unsigned long to support values larger than 31 and avoid overflow.
For example: If we try to register 4GB of memory that is contiguous in physical memory, the driver will optimize the page_size and try to use an mkey with 4GB entity size. The 'unsigned int' page_size variable will overflow to '0' and we'll hit the WARN_ON() in alloc_cacheable_mr().
WARNING: CPU: 2 PID: 1203 at drivers/infiniband/hw/mlx5/mr.c:1124 alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Modules linked in: mlx5_ib mlx5_core bonding ip6_gre ip6_tunnel tunnel6 ip_gre gre rdma_rxe rdma_ucm ib_uverbs ib_ipoib ib_umad rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm fuse ib_core [last unloaded: mlx5_core] CPU: 2 UID: 70878 PID: 1203 Comm: rdma_resource_l Tainted: G W 6.14.0-rc4-dirty #43 Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:alloc_cacheable_mr+0x22/0x580 [mlx5_ib] Code: 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 41 52 53 48 83 ec 30 f6 46 28 04 4c 8b 77 08 75 21 <0f> 0b 49 c7 c2 ea ff ff ff 48 8d 65 d0 4c 89 d0 5b 41 5a 41 5c 41 RSP: 0018:ffffc900006ffac8 EFLAGS: 00010246 RAX: 0000000004c0d0d0 RBX: ffff888217a22000 RCX: 0000000000100001 RDX: 00007fb7ac480000 RSI: ffff8882037b1240 RDI: ffff8882046f0600 RBP: ffffc900006ffb28 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000007e0 R11: ffffea0008011d40 R12: ffff8882037b1240 R13: ffff8882046f0600 R14: ffff888217a22000 R15: ffffc900006ffe00 FS: 00007fb7ed013340(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb7ed1d8000 CR3: 00000001fd8f6006 CR4: 0000000000772eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __warn+0x81/0x130 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] ? report_bug+0xfc/0x1e0 ? handle_bug+0x55/0x90 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? alloc_cacheable_mr+0x22/0x580 [mlx5_ib] create_real_mr+0x54/0x150 [mlx5_ib] ib_uverbs_reg_mr+0x17f/0x2a0 [ib_uverbs] ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xca/0x140 [ib_uverbs] ib_uverbs_run_method+0x6d0/0x780 [ib_uverbs] ? __pfx_ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0x10/0x10 [ib_uverbs] ib_uverbs_cmd_verbs+0x19b/0x360 [ib_uverbs] ? walk_system_ram_range+0x79/0xd0 ? ___pte_offset_map+0x1b/0x110 ? __pte_offset_map_lock+0x80/0x100 ib_uverbs_ioctl+0xac/0x110 [ib_uverbs] __x64_sys_ioctl+0x94/0xb0 do_syscall_64+0x50/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fb7ecf0737b Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 7d 2a 0f 00 f7 d8 64 89 01 48 RSP: 002b:00007ffdbe03ecc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffdbe03edb8 RCX: 00007fb7ecf0737b RDX: 00007ffdbe03eda0 RSI: 00000000c0181b01 RDI: 0000000000000003 RBP: 00007ffdbe03ed80 R08: 00007fb7ecc84010 R09: 00007ffdbe03eed4 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffdbe03eed4 R13: 000000000000000c R14: 000000000000000c R15: 00007fb7ecc84150 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-abi-stablelistsUpgrade kernel-64k-debug-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-64kUpgrade kernelUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade kernel-rt-64k-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-64k-coreUpgrade kernel-rt-64k-modules-coreUpgrade kernel-modulesUpgrade kernel-rt-64k-debugUpgrade libperfUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdumpUpgrade kernel-64k-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade kernel-64k-debugUpgrade kernel-rt-debug-develUpgrade kernel-rt-64k-debug-coreUpgrade kernel-cross-headersUpgrade kernel-debug-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-rtUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-coreUpgrade rtlaUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-tools-libsUpgrade kernel-docUpgrade rvUpgrade kernel-64k-debug-modulesUpgrade kernel-rt-64k-debug-develUpgrade kernel-develUpgrade kernel-modules-extraUpgrade python3-perfUpgrade kernel-rt-debug-modulesUpgrade kernel-64k-debug-develUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-rt-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-64k-develUpgrade kernel-rt-modules-extraUpgrade kernel-rt-coreUpgrade perfUpgrade kernel-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-64k-modules-coreUpgrade kernel-uki-virtUpgrade kernel-rt-64kUpgrade kernel-debug-develUpgrade kernel-64k-develUpgrade kernel-rt-64k-coreUpgrade kernel-debug-uki-virt | Aug 4, 2025 | Jul 28, 2025 |
| Amazon_linux_2023 | — | Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade perf6.12Upgrade kernel-libbpf-debuginfoUpgrade kernel6.12Upgrade kernel6.12-debuginfo-common-x86_64Upgrade perf6.12-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-libbpf-develUpgrade kernel-tools-develUpgrade kernel-livepatch-6.12.23-29.97Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-modules-extraUpgrade python3-perf6.12Upgrade kernel-tools-debuginfo | Jun 24, 2025 | Apr 16, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel | Jul 31, 2025 | Apr 16, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jul 9, 2025 | Apr 16, 2025 |
| Rocky_linux | — | Upgrade python3-perf-debuginfoUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-tools-libs-develUpgrade kernel-develUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade rvUpgrade kernel-toolsUpgrade kernel-rt-debug-modules-coreUpgrade kernel-zfcpdump-modules-coreUpgrade libperf-debuginfoUpgrade kernel-debuginfo-common-s390xUpgrade perfUpgrade kernel-debug-modulesUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-coreUpgrade kernel-rt-modules-extraUpgrade kernel-uki-virt-addonsUpgrade kernel-modules-extraUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade kernel-debug-devel-matchedUpgrade kernel-modules-coreUpgrade kernel-uki-virtUpgrade python3-perfUpgrade libperfUpgrade kernel-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-cross-headersUpgrade kernel-tools-debuginfoUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-debug-modules-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-coreUpgrade rtlaUpgrade perf-debuginfoUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-debug | Feb 5, 2026 | Oct 4, 2025 |
| Suse | — | Upgrade kernel-syms-azureUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade kernel-64kb-develUpgrade reiserfs-kmp-defaultUpgrade kernel-64kbUpgrade kernel-sourceUpgrade kernel-default-develUpgrade kernel-macrosUpgrade kernel-develUpgrade kernel-obs-qaUpgrade kernel-docsUpgrade kernel-kvmsmall-develUpgrade kernel-source-azureUpgrade kernel-azure-extraUpgrade kernel-default-livepatchUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-buildUpgrade kernel-azure-develUpgrade kernel-default-baseUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade kernel-azure-vdsoUpgrade kernel-default-vdso | Dec 5, 2025 | Jul 29, 2025 |
| Ubuntu | — | Upgrade linux-image-6.14.0-22-genericUpgrade linux-image-6.14.0-1007-aws-64kUpgrade linux-image-6.14.0-1007-azureUpgrade linux-image-gcpUpgrade linux-image-6.14.0-1007-azure-fdeUpgrade linux-image-6.14.0-1007-oracleUpgrade linux-image-awsUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-6.14.0-1008-gcp-64kUpgrade linux-image-oracle-64kUpgrade linux-image-6.14.0-1007-awsUpgrade linux-image-genericUpgrade linux-image-6.14.0-1007-oracle-64kUpgrade linux-image-6.14.0-1004-realtimeUpgrade linux-image-azure-fdeUpgrade linux-image-6.14.0-1007-raspiUpgrade linux-image-6.14.0-22-generic-64kUpgrade linux-image-generic-64kUpgrade linux-image-6.14.0-1008-gcpUpgrade linux-image-oracleUpgrade linux-image-aws-64k | Jun 26, 2025 | Apr 16, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub