NVIDIA/Mellanox ConnectX driver (mlx5 core completion-queue creation defaults): Every CQ created without an explicit
Impact
Every CQ created without an explicit completion handler was defaulted to mlx5_add_cq_to_tasklet, a function only user CQs created through mlx5_ib are meant to use, and the default creation path left a valid value in the CQ's arm_db so firmware could raise interrupts on completion queues that were only ever meant to be polled. The result is a kernel-internal, polling-only completion queue being driven by a hardware interrupt into a completion handler intended for a different class of object - a firmware-triggered control-flow crossing between the user-facing and kernel-internal halves of the same adapter.
Who can reach it
Local/adapter-level. Requires the corner-case interrupt condition on a polling-only kernel CQ; the tenant influences adapter interrupt load, not the handler choice directly.
What to do
Kernel update that stops defaulting the completion function and clears arm_db for polling-only CQs. No workaround.
References
Related entries
- vGPU Manager: Guest-to-host escape (use-after-free in GPU context mgmt)CVE-2026-24200 · vGPU ManagerHigh
- NVIDIA GPU driver for Windows: out-of-bounds write in the kernel module leads to code executionCVE-2026-47582 · NVIDIA GPU Display Driver for Windows (kernel module)High
- NVIDIA GPU driver for Linux: read-only memory becomes writable because permissions are not preservedCVE-2026-47596 · NVIDIA GPU Display Driver for Linux (kernel mode layer memory permissions)High
- NVIDIA open GPU kernel module: use-after-free in the event delivery path races file closeCVE-2026-47598 · NVIDIA open GPU kernel module (asynchronous event delivery vs file close race)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2026-53329 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
- Linux kernel amdgpu display core (DC/DM) (drm/amd/display): An out-of-bounds access in the amdgpu display core (DC/DM)CVE-2026-64219 · Linux kernel amdgpu display core (DC/DM) (drm/amd/display)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.