Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): Nothing orders the PTP send-queue tracking list against

CVSS 6.5CVE-2024-26858Firmware, BMC & network fabriccurated

Impact

Nothing orders the PTP send-queue tracking list against population of the timestamp metadata map, so the compiler or the CPU can publish a queue entry before its metadata exists. The NAPI poll path on another CPU then walks the list and dereferences NULL, panicking the node and taking down every co-tenant workload with it.

Who can reach it

Reachable from ordinary unprivileged socket traffic: any local process that requests hardware TX timestamping (SO_TIMESTAMPING) routes packets through the mlx5e PTP send queue, and the race is between that transmit and NAPI completion on a different CPU. A tenant container needs no device node and no capability - just a socket. Requires the mlx5e PTP TX queue to be active (hardware timestamping enabled on the interface, which is normal on clusters running PTP time sync).

What to do

Update to 6.6.22 or later on the 6.6.x branch, or a mainline kernel from 6.6 onward carrying the memory-barrier fix. Interim control: disable hardware TX timestamping on the mlx5 interface where PTP time sync is not required, which retires the vulnerable send queue.

References

https://git.kernel.org/stable/c/936ef086161ab89a7f38f7a0761d6a3063c3277e https://git.kernel.org/stable/c/b7cf07586c40f926063d4d09f7de28ff82f62b2a https://nvd.nist.gov/vuln/detail/CVE-2024-26858

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.