Executive brief
The Linux kernel's InfiniBand mlx5 driver contains a race condition in how it handles memory region re-registration for implicit On-Demand Paging (ODP) configurations. This race allows concurrent access to shared data structures (mr->pd) without proper synchronization, potentially leading to memory corruption or system instability in systems using mlx5-based InfiniBand network adapters.
Technical details
The vulnerability is a race condition in the mlx5_ib_rereg_user_mr() function in drivers/infiniband/hw/mlx5/mr.c. When implicit ODP memory regions are re-registered without specifying a new translation, the code incorrectly attempts to modify the parent mkey in place despite having multiple child mkeys that reference it, and accesses mr->pd without proper locking. The fix adds logic to detect this scenario and forces a complete rebuild of the memory region with fixed implicit values instead of in-place modification. The race condition only affects systems using mlx5-based InfiniBand adapters with implicit ODP features enabled; no public exploits are known.
Affected products
- Linux Linux kernel Versions with mlx5 driver and ODP support (approximately 4.9 and later)
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-06-03: patched: Upstream fix committed by Jason Gunthorpe
- 2026-07-24: patched: Backported to stable kernel releases