Linux kernel mlx5_core representor TC path + net/sched tc extension: The TC_SKB_EXT skb extension is not zeroed

Impact

The TC_SKB_EXT skb extension is not zeroed on allocation and mlx5's representor restore path never initialized the newer fields, so Open vSwitch reads uninitialized kernel memory as a boolean. This leaks host kernel memory contents into the OVS datapath - and it is triggered remotely, by sending packets that miss hardware offload. On a switchdev host running OVS over ConnectX, that is remote kernel-memory disclosure into the software datapath.

Who can reach it

Remote, unauthenticated: send traffic crafted to miss the hardware offload path on an mlx5 switchdev host running OVS.

What to do

Upgrade the host kernel to 5.13 or a stable backport (5.10.42, 5.12.9). Rolling reboot. Note NVD scores this 5.5 while the kernel CNA scores it 8.6 - if you triage from NVD feeds you will under-prioritize it.

References