Executive brief
A vulnerability in the Linux kernel's Mellanox (mlx5) network driver can cause a system crash. When the system runs out of available interrupt resources, the driver incorrectly deletes active memory mappings, leading to a kernel panic. This primarily affects high-performance networking environments and can result in a complete loss of service availability.
Technical details
A vulnerability exists in the net/mlx5 driver of the Linux kernel within the mlx5_irq_alloc() function. When request_irq() fails (e.g., due to exhausted IRQ vectors), the error handling logic inadvertently frees the entire CPU affinity reverse map (rmap) instead of just the failed mapping. This creates a race condition or use-after-free scenario where other threads attempting to access the rmap trigger a general protection fault or kernel panic. The issue is specifically observed in configurations where dynamic MSI-X vector allocation is used, often involving fwctl and rds configs. Patches have been released for various stable kernel branches to ensure only the specific failed IRQ mapping is cleaned up.
Affected products
- Linux Linux Kernel Versions using dynamic MSI-X vector allocation in mlx5 driver
Timeline
- 2025-11-17: other: Patch authored
- 2025-12-01: patched: Patch committed to stable tree
- 2025-12-04: disclosed: CVE published
References
- https://git.kernel.org/stable/c/4d6b4bea8b80bfa13c903ba547538249e7c5e977
- https://git.kernel.org/stable/c/69e043bce09c9a77e5f55b9ac7505874a2a1a9f0
- https://git.kernel.org/stable/c/6ebd02cf2dde11b86f89ea4c9f55179eab30d4ee
- https://git.kernel.org/stable/c/d47515af6cccd7484d8b0870376858c9848a18ec
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html