Linux kernel mlx5_core eswitch vport representors / IPsec FS: TENANT ISOLATION: during driver unload the vport

Impact

TENANT ISOLATION: during driver unload the vport representor private struct is freed before unregister_netdev runs, so the kernel walks freed representor state across every VF on the box. Vport representors are the per-tenant hooks in switchdev mode; a use-after-free walking all of them on a shared host is a host-kernel corruption reachable through ordinary driver lifecycle events.

Who can reach it

Local - triggered on mlx5 driver unload/reload on a switchdev SR-IOV host. Reachable by anyone who can induce a driver reload (operator action, firmware reset flow, or a fault path an attacker provokes).

What to do

Upgrade the host kernel to 6.13 or a stable backport (6.6.70, 6.12.9). Rolling reboot. Until then, avoid mlx5 driver unload/reload on live switchdev hosts - use full node reboots instead of in-place driver restarts.

References