NVIDIA/Mellanox ConnectX driver (mlx5_ib user access region index release): The driver released the software-side UAR

Impact

The driver released the software-side UAR index rather than the index the hardware actually handed back. User access regions are the doorbell pages the driver maps into each tenant's address space; returning the wrong index to the allocator desynchronises the allocator from the hardware, so an index still owned by one context can be handed to the next one that asks. Two tenants sharing a doorbell page is a direct isolation failure on the ConnectX adapter, not merely a leak.

Who can reach it

Local. Occurs on the ordinary allocate/free cycle of RDMA user contexts, so a tenant that repeatedly creates and destroys contexts drives the desynchronisation.

What to do

Kernel update freeing the hardware-provided UAR index. Nothing to tune - patch and reboot. The kernel CNA record is terse on exploitation detail; treat the doorbell-aliasing consequence described here as the operator-facing reading of the fix, and confirm against your own driver version before ranking it.

References