Linux kernel mlx5_ib on-demand paging (ODP): Implicit on-demand-paging memory region destroy work can be queued twice

Impact

Implicit on-demand-paging memory region destroy work can be queued twice, so the second run touches an already-freed MR - a refcount underflow and use-after-free. ODP is what lets RDMA register memory lazily, which is heavily used by large-model training frameworks, so this is reachable from ordinary tenant RDMA registration patterns on a GPU node.

Who can reach it

Local, low-privileged - a tenant process registering and tearing down ODP memory regions through libibverbs.

What to do

Upgrade the host kernel to 6.14 or a stable backport (6.12.13, 6.13.2). Rolling reboot of nodes where ODP is enabled.

References