Linux kernel mlx5_ib (pkey change notifier): A race between InfiniBand device deregistration and the pkey-change work

Impact

A race between InfiniBand device deregistration and the pkey-change work item leaves the handler running after the device is gone, causing a NULL dereference. Pkey changes are pushed by the subnet manager, so a fabric-side event - benign reconfiguration or a hostile SM - can crash hosts that are cycling their RDMA devices.

Who can reach it

Adjacent, unauthenticated: an actor able to cause partition-key change events on the subnet (a compromised or spoofed subnet manager) combined with device teardown on the target.

What to do

Upgrade the host kernel to 6.13 or a stable backport (6.6.64, 6.11.11, 6.12.2). Rolling reboot of RDMA hosts. Complementary control: lock down who can run a subnet manager on the fabric and set SM priority so a rogue SM cannot take over.

References