Linux kernel mlx5_ib (create QP response): mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creating

Impact

mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creating a queue pair returns uninitialized kernel stack memory to the calling process. Low severity on its own, but it is a free kernel-stack read for any tenant with RDMA access, useful for defeating address-space layout randomization before a heavier exploit.

Who can reach it

Local, low-privileged - any user able to create an RDMA queue pair through libibverbs, which on a GPU cluster is every workload using RDMA collectives.

What to do

Upgrade the host kernel past 4.18.7 or take the distro backport. Any modern kernel already carries this; the value here is checking that legacy long-lived nodes in the fleet are not still on pre-4.18 kernels. Host reboot to apply.

References

Related entries

• Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selection: Setting Speculative Store Bypass Disable on AMD FamilyCVE-2022-42336 · Xen on AMD Family 17h / Hygon Family 18h - guest SSBD selectionLow
• OpenSSH sshd: restrict keyword in authorized_keys did not cover tunnel forwardingCVE-2026-73283 · OpenSSH sshd (authorized_keys restrict keyword vs tunnel forwarding)Low
• QEMU / KVM / Xen (VENOM): VENOM: out-of-bounds write in the virtual Floppy Disk ControllerCVE-2015-3456 · QEMU / KVM / Xen (VENOM)Low
• Xen (shadow paging): x86 shadow paging arbitrary pointer dereference - host crash or worseCVE-2022-42335 · Xen (shadow paging)Unscored
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDCVE-2022-50619 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Unscored
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2023-54144 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Unscored