Linux kernel mlx5_core RX datapath (SHAMPO / HW-GRO): A remote sender can make the mlx5 receive path release a SHAMPO

Impact

A remote sender can make the mlx5 receive path release a SHAMPO header page while it is still in use, giving a double release and DMA into freed memory. This runs in NAPI softirq on every inbound frame, before any socket lookup or credential check - so an unauthenticated peer anywhere that can route packets to the node corrupts host kernel memory on the primary datacenter NIC. Note that NVD rates this 5.5 while the assigning kernel.org CNA rates it 9.8; the CNA score is the one that reflects reachability.

Who can reach it

Unauthenticated remote attacker able to send network traffic to a node running mlx5 with HW-GRO/SHAMPO enabled. No account, no VM, no adjacency needed.

What to do

Upgrade the host kernel to 6.11 or a stable backport (6.1.109, 6.6.50, 6.10.9). Rolling reboot of every ConnectX/BlueField host. Immediate mitigation without reboot: disable HW-GRO on the mlx5 interfaces (ethtool -K <dev> rx-gro-hw off), which takes the SHAMPO path out of service at some throughput cost.

References