CVE-2024-38555

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually. Kernel log: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: <IRQ> ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 27c79b3a9212cf4ba634c157e07d29548181a208 < f6fbb8535e990f844371086ab2c1221f71f993d3, >= 51d138c2610a236c1ed0059d034ee4c74f452b86 < 3cb92b0ad73d3f1734e812054e698d655e9581b0, >= 51d138c2610a236c1ed0059d034ee4c74f452b86 < bf8aaf0ae01c27ae3c06aa8610caf91e50393396, >= 51d138c2610a236c1ed0059d034ee4c74f452b86 < 1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb, >= 51d138c2610a236c1ed0059d034ee4c74f452b86 < 1d5dce5e92a70274de67a59e1e674c3267f94cd7, >= 51d138c2610a236c1ed0059d034ee4c74f452b86 < 7ac4c69c34240c6de820492c0a28a0bd1494265a, >= 51d138c2610a236c1ed0059d034ee4c74f452b86 < db9b31aa9bc56ff0d15b78f7e827d61c4a096e40, >= 2e5d24b3bf091802c5456dc8f8f6a6be4493c8ca, >= 5.10.20 < 5.10.219, >= 5.11.3 < 5.12, >= 5.12, >= 5.12 < 5.15.161, >= 5.16 < 6.1.93, >= 6.2 < 6.6.33, >= 6.7 < 6.8.12, >= 6.9 < 6.9.3

Fixed versions

5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.8.12, 6.9.3

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416