Linux kernel mlx5_core RX datapath (striding RQ + XDP multi-buffer): The mlx5 driver assumed an XDP program could

Impact

The mlx5 driver assumed an XDP program could not change the xdp_buff layout. It can, via bpf_xdp_adjust_head/tail - and when it shrinks non-linear data the driver hits a BUG_ON, or builds a malformed skb. Any node running an XDP program on mlx5 (load balancers, DDoS scrubbers, CNI dataplanes like Cilium) can be crashed or memory-corrupted by remote packets. Jumbo-MTU routed fabrics are standard in datacenters, so the attacker does not need to be L2-adjacent.

Who can reach it

Unauthenticated remote sender, provided the target node runs an XDP program on an mlx5 interface with striding RQ.

What to do

Upgrade the host kernel to 6.18 or a stable backport (6.6.115, 6.12.56, 6.17.6). Rolling reboot. Interim: unload the XDP program from mlx5 interfaces if you can accept the performance/feature loss - a live config change.

References