Linux kernel (drivers/net/ethernet/mellanox/mlx5/core/en/xsk): An RX buffer on the legacy receive queue is released

Impact

An RX buffer on the legacy receive queue is released twice - once by the XDP_REDIRECT path and again by the mlx5 driver - so a page that has already gone back to the allocator is still owned by the NIC receive ring. That is a classic double-free/use-after-free on the packet path: the freed page can be handed to another workload while the device keeps DMAing peer-supplied packet bytes into it, and the observed symptom is a general protection fault that panics the whole node.

Who can reach it

Reachable from the RX packet path, so any peer able to send frames to the node's Ethernet interface drives the code. Conditional on AF_XDP zero-copy being in use on an mlx5 interface configured with legacy (non-striding) RQ - typical for a tenant or host agent running an XDP/AF_XDP dataplane. No tenant device node is needed; the corruption happens in shared kernel memory on the host, so a single affected node is a blast radius covering every tenant on it.

What to do

Boot a kernel with the fix (6.4.10 or later on that stream, plus the corresponding backports). Interim: stop running AF_XDP zero-copy sockets on mlx5 interfaces, or switch the affected interfaces to striding RQ so the legacy-RQ path is not used.

References