Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en): The transmit health reporter's dump callback casts its

CVSS 6.5CVE-2021-46931Firmware, BMC & network fabriccurated

Impact

The transmit health reporter's dump callback casts its argument to the wrong structure type on the TX-timeout recovery path. The type confusion walks bogus pointers, overflows the kernel stack past the guard page and panics the machine - a single stuck transmit queue turns into a fatal crash that takes every tenant on the node with it.

Who can reach it

The trigger is a TX timeout on an mlx5 queue, which is reachable through fabric-level conditions (severe congestion, link flap, a queue wedged by a heavy neighbour) rather than through a tenant device node. No privileges are required to be the workload that causes the stalled queue, but there is no direct attacker-controlled input - treat this as a shared-node availability and memory-safety defect, not a targeted exploit path.

What to do

Update to a patched kernel on your stream. There is no configuration workaround short of disabling the devlink TX health reporter's dump on affected kernels; plan node reboots.

References

https://git.kernel.org/stable/c/73665165b64a8f3c5b3534009a69be55bb744f05 https://git.kernel.org/stable/c/07f13d58a8ecc3baf9a488588fb38c5cb0db484f https://nvd.nist.gov/vuln/detail/CVE-2021-46931

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.