Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): When the driver runs out of firmware command slots, the work

CVSS 5.5CVE-2025-21662Firmware, BMC & network fabriccurated

Impact

When the driver runs out of firmware command slots, the work handler bails out without signalling the waiting task, so that task blocks forever. The mlx5 command interface is the single control path for the NIC, so one wedged caller cascades into hung kernel workers and a NIC whose queues, RDMA objects and interrupt moderation can no longer be reconfigured - a fabric stall for every tenant on the node, cleared only by reboot.

Who can reach it

Requires exhausting the mlx5 firmware command index pool, which a tenant can drive from inside a container holding /dev/infiniband/uverbs* (each verbs/DEVX object creation issues a firmware command) or from a VF assigned into a tenant VM. No host privilege and no fabric access needed; the only precondition is enough concurrent command pressure to make cmd_alloc_index() fail.

What to do

Update to 6.1.125 / 6.6.72 or later on those stable branches, or to 6.9/6.10 and later mainline. Interim controls: rate-limit or cap per-tenant RDMA resource creation, and drop /dev/infiniband/* from containers that do not need verbs.

References

https://git.kernel.org/stable/c/229cc10284373fbe754e623b7033dca7e7470ec8 https://git.kernel.org/stable/c/36124081f6ffd9dfaad48830bdf106bb82a9457d https://nvd.nist.gov/vuln/detail/CVE-2025-21662

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.