Linux kernel mlx5_core TX timeout devlink health reporter: The TX timeout recovery path runs without the state lock, so

Impact

The TX timeout recovery path runs without the state lock, so it races channel teardown. The racing side is driven by unprivileged statistics reads - cat /proc/net/dev, ip -s link, or anything scraping /sys/class/net/*/statistics/*. That requeues the stats work while the channels are being freed, giving a reliable use-after-free read of groomable slab memory from an ordinary unprivileged account. Every Prometheus node-exporter on the fleet is polling exactly these files.

Who can reach it

Local unprivileged user reading standard network statistics, combined with a TX timeout or channel reconfiguration. No special capability needed.

What to do

Upgrade the host kernel to a build carrying the fix (6.11 and the corresponding stable backports). Rolling reboot of the fleet. No practical config mitigation - you are not going to stop metrics collection.

References