Executive brief
The Linux kernel's mlx5 RDMA driver contains a memory management bug where the wrong User Access Region (UAR) index is freed during error handling, leaving hardware-allocated resources unreleased. This causes resource exhaustion on systems using Mellanox/NVIDIA InfiniBand adapters, potentially leading to denial of service when UAR resources become depleted.
Technical details
The vulnerability is a resource management error in the RDMA/mlx5 driver (drivers/infiniband/hw/mlx5/main.c). During dynamic UAR allocation error handling, the code incorrectly deallocates a software-computed index (`idx`) instead of the hardware-provided UAR index (`uar_index`), resulting in a resource leak. The bug affects the mlx5_cmd_uar_dealloc() call path when dyn_uar allocation fails. An attacker or resource-exhausted condition can deplete available UAR indices, preventing legitimate RDMA operations and causing denial of service on high-performance computing or storage systems. The fix is a one-line correction to use the correct variable. This affects all Linux kernel versions with dynamic mmap allocation support.
Affected products
- Linux Linux kernel all versions with RDMA mlx5 dynamic mmap support
Timeline
- 2026-08-15: disclosed
- 2026-06-11: patched