Linux kernel mlx5_ib (create QP response): mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creating

Impact

mlx5_ib_create_qp_resp is never initialized in create_qp_common, so creating a queue pair returns uninitialized kernel stack memory to the calling process. Low severity on its own, but it is a free kernel-stack read for any tenant with RDMA access, useful for defeating address-space layout randomization before a heavier exploit.

Who can reach it

Local, low-privileged - any user able to create an RDMA queue pair through libibverbs, which on a GPU cluster is every workload using RDMA collectives.

What to do

Upgrade the host kernel past 4.18.7 or take the distro backport. Any modern kernel already carries this; the value here is checking that legacy long-lived nodes in the fleet are not still on pre-4.18 kernels. Host reboot to apply.

References