Linux kernel mlx5_core TC connection tracking offload: Updating a connection-tracking entry allocates a replacement

Impact

Updating a connection-tracking entry allocates a replacement modify-header context; if that allocation fails - which it does once you exceed the firmware's maximum, a state an attacker can drive by opening many connections - the error pointer is stored and later dereferenced on free, panicking the kernel, and the old context is leaked. Remote traffic volume alone is enough to reach it on a node doing hardware conntrack offload.

Who can reach it

Remote, unauthenticated: open enough tracked connections through an mlx5 host doing CT offload to exhaust the firmware's modify-header capacity.

What to do

Upgrade the host kernel to 6.11 or a stable backport (6.6.45, 6.10.4). Rolling reboot. Interim: disable hardware connection-tracking offload on the mlx5 interfaces or cap conntrack table size, both live config changes.

References