GPU VulnDB

Database/NVIDIA / GPU stack

NVIDIA/Mellanox ConnectX driver (mlx5 core completion-queue creation defaults): Every CQ created without an explicit

CVE-2025-68209NVIDIA / GPU stackcurated

Impact

Every CQ created without an explicit completion handler was defaulted to mlx5_add_cq_to_tasklet, a function only user CQs created through mlx5_ib are meant to use, and the default creation path left a valid value in the CQ's arm_db so firmware could raise interrupts on completion queues that were only ever meant to be polled. The result is a kernel-internal, polling-only completion queue being driven by a hardware interrupt into a completion handler intended for a different class of object - a firmware-triggered control-flow crossing between the user-facing and kernel-internal halves of the same adapter.

Who can reach it

Local/adapter-level. Requires the corner-case interrupt condition on a polling-only kernel CQ; the tenant influences adapter interrupt load, not the handler choice directly.

What to do

Kernel update that stops defaulting the completion function and clears arm_db for polling-only CQs. No workaround.

References

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.