Linux kernel (drivers/vfio/pci/mlx5): Pages allocated for a device migration buffer are not freed when adding them to

CVSS 4.7CVE-2024-56742Firmware, BMC & network fabriccurated

Impact

Pages allocated for a device migration buffer are not freed when adding them to the scatter-gather table fails, leaking host memory on every failed attempt. On a fleet that live-migrates SR-IOV NIC functions between tenants, repeated failures bleed host RAM that never comes back.

Who can reach it

The mlx5 VFIO variant driver's migration buffer path, exercised by the host's migration control plane with a size influenced by the tenant device's state. Requires the SG-table add to fail, i.e. memory pressure. Conditional on ConnectX VFs being passed through with live migration enabled - common on ConnectX-backed neoclouds. Host-side path, not a direct tenant ioctl.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: monitor host memory across migration failures and drain nodes that show unexplained kernel memory growth.

References

https://git.kernel.org/stable/c/769fe4ce444b646b0bf6ac308de80686c730c7df https://git.kernel.org/stable/c/c44f1b2ddfa81c8d7f8e9b6bc76c427bc00e69d5 https://nvd.nist.gov/vuln/detail/CVE-2024-56742

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.