Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en): The transmit health reporter's dump callback casts its

Impact

The transmit health reporter's dump callback casts its argument to the wrong structure type on the TX-timeout recovery path. The type confusion walks bogus pointers, overflows the kernel stack past the guard page and panics the machine - a single stuck transmit queue turns into a fatal crash that takes every tenant on the node with it.

Who can reach it

The trigger is a TX timeout on an mlx5 queue, which is reachable through fabric-level conditions (severe congestion, link flap, a queue wedged by a heavy neighbour) rather than through a tenant device node. No privileges are required to be the workload that causes the stalled queue, but there is no direct attacker-controlled input - treat this as a shared-node availability and memory-safety defect, not a targeted exploit path.

What to do

Update to a patched kernel on your stream. There is no configuration workaround short of disabling the devlink TX health reporter's dump on affected kernels; plan node reboots.

References