Linux kernel mlxbf_gige (BlueField out-of-band management NIC): NULL function-pointer dereference when the DPU's

CVE-2024-35907Firmware, BMC & network fabricmlxbf_gige call request_irq() after NAPI initializedcurated

Impact

NULL function-pointer dereference when the DPU's oob_net0 interface comes up, reproduced on BlueField-3 under kdump. oob_net0 is the out-of-band management interface on the DPU - the path you use to reach a DPU whose in-band networking is broken. Losing it during a crash-dump or recovery boot means losing the remote hands you were counting on.

Who can reach it

Local on the DPU - triggered by interface bring-up during kdump or an unusual boot sequence, not by an external attacker.

What to do

Upgrade the DPU Arm-side kernel to 6.9 or a stable backport (5.15.154, 6.1.85, 6.6.26, 6.8.5), delivered as a DOCA/BFOS package upgrade or BFB re-image with a DPU reset per node. Bundle with other DPU-side fixes into one maintenance pass.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-35907 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-35907.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.