Linux kernel mlx5_ib: implicit ODP parent mkey re-registered in place, racing its child mkeys and mr->pd

Impact

With implicit on-demand paging the parent mkey owns a tree of child mkeys, so nothing about it can be changed in place; the driver nonetheless allowed rereg_mr to mutate it, and implicit children were also touching mr->pd, which the commit message calls out as a further racy access. The fix forces implicit values when the user supplies no translation, so the request falls through to mlx5_ib_reg_user_mr() and a wholly new MR is allocated instead. This is the ConnectX RDMA path that GPUDirect and multi-node training traffic ride on, so the blast radius is a fabric-facing driver on every node in a training job. The record does not state an exploitability outcome or a score, and there is no CVSS in it - treat it as a memory-region lifetime bug reachable from local RDMA users, not as a demonstrated remote compromise.

Who can reach it

Local user with access to the uverbs device on an mlx5 host who can register an implicit ODP memory region and then call rereg_mr on it. No authentication beyond access to the RDMA device, which tenants get whenever RDMA is exposed into their pods.

What to do

Take the stable commits in the record; the record gives no fixed version string. Rolling it out is a kernel update and a node reboot, which for RDMA nodes usually means draining a whole training job rather than one pod. There is no mitigation short of not exposing ODP-capable RDMA registration to untrusted tenants.

References

Related entries

• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored
• NVMe-oF over RDMA: NVMe-over-Fabrics inherits RDMA's lack of authenticationNCVD-0000-006-nvme-of-over-rdma · NVMe-oF over RDMAUnscored