Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): The async firmware-command context can be freed while a

Impact

The async firmware-command context can be freed while a completion callback is still running, so the completion handler writes into a freed slab object from interrupt context. That is a kernel heap corruption primitive on a node shared with other tenants, and at minimum a panic that takes every workload on the box down with it.

Who can reach it

Needs code executing on the node that opens mlx5 async firmware-command channels and then tears them down while commands are in flight. The realistic holder is a tenant container with /dev/infiniband/uverbs* and DEVX enabled, or a VF driver instance inside a tenant VM; host-root paths (devlink reload, eswitch mode changes) reach the same race. Not reachable from the RDMA/IP fabric.

What to do

Boot a kernel carrying the mlx5_core fix (the kernel CNA published no fixed-version list for this ID - match the stable commits below against your distro's mlx5_core backport). Interim control: remove /dev/infiniband/* from untrusted containers and do not grant DEVX to tenant workloads.

References