Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): The async firmware-command context can be freed while a

CVSS 7.8CVE-2022-50726Firmware, BMC & network fabriccurated

Impact

The async firmware-command context can be freed while a completion callback is still running, so the completion handler writes into a freed slab object from interrupt context. That is a kernel heap corruption primitive on a node shared with other tenants, and at minimum a panic that takes every workload on the box down with it.

Who can reach it

Needs code executing on the node that opens mlx5 async firmware-command channels and then tears them down while commands are in flight. The realistic holder is a tenant container with /dev/infiniband/uverbs* and DEVX enabled, or a VF driver instance inside a tenant VM; host-root paths (devlink reload, eswitch mode changes) reach the same race. Not reachable from the RDMA/IP fabric.

What to do

Boot a kernel carrying the mlx5_core fix (the kernel CNA published no fixed-version list for this ID - match the stable commits below against your distro's mlx5_core backport). Interim control: remove /dev/infiniband/* from untrusted containers and do not grant DEVX to tenant workloads.

References

https://git.kernel.org/stable/c/69dd3ad406c49aa69ce4852c15231ac56af8caf9 https://git.kernel.org/stable/c/ab3de780c176bb91995c6166a576b370d9726e17 https://nvd.nist.gov/vuln/detail/CVE-2022-50726

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.