Linux kernel mlx5_core flow steering / flow counters (hardware steering): Use-after-free releasing

Impact

Use-after-free releasing the hardware-steering action of a local flow counter - the refcount and mutex were never initialized and the counter struct can already be freed when the rule is deleted. Notably it is reached through an ib_uverbs ioctl into mlx5_ib_destroy_flow, so a tenant holding an RDMA verbs handle can drive host kernel memory corruption in the NIC's flow-steering tables.

Who can reach it

Local, low-privileged - reachable from a userspace RDMA verbs handle destroying a flow, not only from privileged tc/devlink paths.

What to do

Upgrade the host kernel to 6.17 or the 6.16.10 stable backport. Rolling reboot of the fleet.

References