Linux kernel mlx5_ib: UMR completion wait hangs forever when a bonded ConnectX pair is reset

CVSS 5.5CVE-2026-45973Firmware, BMC & network fabriccurated

Impact

On a host whose ConnectX ports are bonded in mlx5 LAG mode, a firmware reset of the adapter races with device teardown: the bond device is registered only on the master, so it never sees the slave's sys_error event. UMR work requests are posted successfully and their completions never arrive, and mlx5_ib unload blocks indefinitely in __mlx5_ib_dereg_mr with the mutex held. The trace shows the hang reached from mlx5_sync_reset_reload_work, i.e. the ordinary firmware-reset path, not an exotic one. For a GPU node this is the bad kind of hang: RDMA is the training fabric, the stuck work is a kernel worker that cannot be killed, and the node needs a reboot to come back, so a rolling NIC firmware update across a bonded RoCE fleet can leave nodes wedged mid-maintenance.

Who can reach it

Not remote and not tenant-reachable. Requires the local privilege to drive an adapter firmware reset or module unload on a host running mlx5 LAG; in practice it shows up as a reliability failure during operator-initiated NIC firmware resets rather than as something an attacker triggers.

What to do

Take the stable kernel fix (a sys_error notifier registered before MLX5_IB_STAGE_IB_REG and kept alive past ib_unregister_device); the commits are linked from the NVD record and are in the stable series. Rolling it out means a kernel update and a reboot of each affected node, since the fix is in the mlx5_ib module and an already-hung node cannot be recovered by reloading it. Until the fix is in place, avoid adapter firmware resets on bonded hosts that are carrying RDMA traffic, and expect a reboot if one hangs. No fixed release version is stated in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-45973 https://git.kernel.org/stable/c/33deba9bf5c34335182342588315f3db7dbc56d3 https://git.kernel.org/stable/c/613f5d4139b6ba801ccd93f9a28943be60d903bc

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.