CVE-2024-38555

net/mlx5: Discard command completions in internal error

HIGH

7.8

CVSS Score

Published: June 19, 2024 at 01:35 PM UTC

Updated: August 5, 2026 at 12:04 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually. Kernel log: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: <IRQ> ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0xa0 common_interrupt+0x7b/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v ≥ 5.11.35.10.20 ≤ v < 5.10.2195.11.3 ≤ v < 5.125.12 ≤ v < 5.15.1615.12 ≤ v < 6.1.935.12 ≤ v < 6.105.12 ≤ v < 6.6.335.12 ≤ v < 6.8.125.12 ≤ v < 6.9.35.16 ≤ v < 6.1.936.2 ≤ v < 6.6.336.7 ≤ v < 6.8.126.9 ≤ v < 6.9.327c79b3a9212cf4ba634c157e07d29548181a2082e5d24b3bf091802c5456dc8f8f6a6be4493c8ca5.10.20 5.11.3 5.1251d138c2610a236c1ed0059d034ee4c74f452b86

Vendor states this is fixed in 1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb (fixed)

Vendor states this is fixed in 1d5dce5e92a70274de67a59e1e674c3267f94cd7 (fixed)

Vendor states this is fixed in 3cb92b0ad73d3f1734e812054e698d655e9581b0 (fixed)

Vendor states this is fixed in 7ac4c69c34240c6de820492c0a28a0bd1494265a (fixed)

Vendor states this is fixed in bf8aaf0ae01c27ae3c06aa8610caf91e50393396 (fixed)

Vendor states this is fixed in db9b31aa9bc56ff0d15b78f7e827d61c4a096e40 (fixed)

Vendor states this is fixed in f6fbb8535e990f844371086ab2c1221f71f993d3 (fixed)

Vendor states this is fixed in 5.10.219 (unaffected)

Vendor states this is fixed in 5.12 (unaffected)

Vendor states this is fixed in 5.15.161 (unaffected)

Vendor states this is fixed in 6.1.93 (unaffected)

Vendor states this is fixed in 6.10 (unaffected)