Linux kernel (drivers/vfio/pci/mlx5): Pages allocated for a device migration buffer are not freed when adding them to

Impact

Pages allocated for a device migration buffer are not freed when adding them to the scatter-gather table fails, leaking host memory on every failed attempt. On a fleet that live-migrates SR-IOV NIC functions between tenants, repeated failures bleed host RAM that never comes back.

Who can reach it

The mlx5 VFIO variant driver's migration buffer path, exercised by the host's migration control plane with a size influenced by the tenant device's state. Requires the SG-table add to fail, i.e. memory pressure. Conditional on ConnectX VFs being passed through with live migration enabled - common on ConnectX-backed neoclouds. Host-side path, not a direct tenant ioctl.

What to do

The record lists no fixed release; boot a kernel carrying the stable fix commits below. Interim control: monitor host memory across migration failures and drain nodes that show unexplained kernel memory growth.

References