Executive brief
The Linux kernel's Mellanox mlx5 network driver has a bug in its multi-port Ethernet Switch (MPESW) component where certain error conditions cause a work queue handler to exit without signaling completion. This can cause system operations waiting for this handler to hang indefinitely, leading to potential service interruptions or system unresponsiveness.
Technical details
The vulnerability is a missing complete() call in the mlx5_mpesw_work() function (net/mlx5 driver, LAG/MPESW component). When mlx5_lag_get_devcom_comp() returns NULL, the function returned early without calling complete(&mpesww->comp), leaving any caller blocked indefinitely on a wait. The fix introduces a "complete" label that all exit paths funnel through, ensuring the waiting thread is always woken. This affects the mlx5 driver's handling of device communication and link aggregation operations. The vulnerability requires the system to be running affected kernel versions; no external network access or privilege escalation is needed to trigger the hang.
Affected products
- Linux Linux kernel affected versions in mlx5/core/lag/mpesw component
Timeline
- 2026-08-28: disclosed
- 2026-06-30: patched: Fix committed upstream; backported to stable branches