Linux kernel mlx5_core RX datapath (SHAMPO): SHAMPO can deliver completion entries with zero consumed strides

CVE-2024-44970Kernel, userspace & hypervisornet/mlx5e SHAMPO invalid WQ linked list unlinkcurated

Impact

SHAMPO can deliver completion entries with zero consumed strides for a work queue entry that was already fully consumed and unlinked, causing a second unlink that corrupts the receive work queue linked list. Remote, unauthenticated corruption of RX ring state on the host NIC - the node's networking dies and the kernel is in an inconsistent state.

Who can reach it

Unauthenticated remote sender of network traffic to an mlx5 host with SHAMPO/HW-GRO active.

What to do

Upgrade the host kernel to 6.11 or a stable backport (6.1.105, 6.6.46, 6.10.5). Rolling reboot fleet-wide. Same interim mitigation as the other SHAMPO bugs: turn off rx-gro-hw via ethtool, a live config change.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-44970 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2024/CVE-2024-44970.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.