Linux kernel (drivers/infiniband/hw/bnxt_re): The driver keeps scheduling completion handlers for a queue pair after

CVSS 7.8CVE-2023-54048Firmware, BMC & network fabriccurated

Impact

The driver keeps scheduling completion handlers for a queue pair after that QP is destroyed, so a poll can run against a completion queue that has already been freed. Upstream captured the resulting panic in bnxt_re_poll_cq. A tenant driving normal destroy-QP / destroy-CQ sequences turns this into a use-after-free on a shared node.

Who can reach it

Local: a tenant holding /dev/infiniband/uverbs* on a Broadcom bnxt_re adapter destroys a QP while its completion queue still has work scheduled, then frees the CQ - the race is reachable entirely through ordinary verbs lifecycle calls. Conditional on bnxt_re hardware.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the completion-flush-before-destroy fix (commits b79a0e71d6e8 / b8500538b8f5). Interim: remove /dev/infiniband device nodes from untrusted tenant containers on bnxt_re nodes.

References

https://git.kernel.org/stable/c/b79a0e71d6e8692e0b6da05f8aaa7d69191cf7e7 https://git.kernel.org/stable/c/b8500538b8f5b2cd86b02754c8de83eaa7a2d6ba https://nvd.nist.gov/vuln/detail/CVE-2023-54048

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.