Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): Nothing orders the PTP send-queue tracking list against

Impact

Nothing orders the PTP send-queue tracking list against population of the timestamp metadata map, so the compiler or the CPU can publish a queue entry before its metadata exists. The NAPI poll path on another CPU then walks the list and dereferences NULL, panicking the node and taking down every co-tenant workload with it.

Who can reach it

Reachable from ordinary unprivileged socket traffic: any local process that requests hardware TX timestamping (SO_TIMESTAMPING) routes packets through the mlx5e PTP send queue, and the race is between that transmit and NAPI completion on a different CPU. A tenant container needs no device node and no capability - just a socket. Requires the mlx5e PTP TX queue to be active (hardware timestamping enabled on the interface, which is normal on clusters running PTP time sync).

What to do

Update to 6.6.22 or later on the 6.6.x branch, or a mainline kernel from 6.6 onward carrying the memory-barrier fix. Interim control: disable hardware TX timestamping on the mlx5 interface where PTP time sync is not required, which retires the vulnerable send queue.

References