Executive brief
A race condition in the Mellanox mlx5 network driver's async command handler can cause a use-after-free memory error. An attacker with local access to trigger rapid mlx5 device teardown could crash the kernel or potentially execute code, disrupting network connectivity and system stability.
Technical details
The vulnerability is a use-after-free in the async command interface of the mlx5 driver (net/mlx5). A race condition exists between mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler: the cleanup function can return and allow the caller to free the mlx5_async_ctx object before all callback handlers have completed, causing the handler to access freed memory when calling wake_up(). The race requires precise timing with inflight callbacks but is reachable through normal mlx5 device driver operations (e.g., TLS context cleanup). The fix uses a completion object to synchronize, ensuring all handlers complete before cleanup returns. This is a kernel-level memory corruption bug affecting any system using the mlx5 driver.
Affected products
- Linux Linux kernel 6.0 and earlier with mlx5 driver
Timeline
- 2025-12-24: disclosed