Linux kernel (drivers/infiniband/hw/mlx5): An event subscription is published to the lookup table before its list head

Impact

An event subscription is published to the lookup table before its list head is initialized, so a device event that arrives in the same instant follows a poison pointer and faults in kernel context. One tenant's event subscription can panic a shared mlx5 node.

Who can reach it

A container holding /dev/infiniband/uverbs* that uses the mlx5 DEVX interface to subscribe to device events, with hardware events arriving concurrently - the tenant controls both the subscription rate and much of the event traffic. DEVX normally requires CAP_NET_RAW, so this needs a privileged container or a tenant explicitly granted raw-network capability; plain verbs users cannot reach it.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: drop CAP_NET_RAW from tenant containers so the DEVX interface is unavailable, which closes this path entirely.

References