Database/Kernel, userspace & hypervisor
Linux kernel mlx5_ib on-demand paging (ODP): Implicit on-demand-paging memory region destroy work can be queued twice
Impact
Implicit on-demand-paging memory region destroy work can be queued twice, so the second run touches an already-freed MR - a refcount underflow and use-after-free. ODP is what lets RDMA register memory lazily, which is heavily used by large-model training frameworks, so this is reachable from ordinary tenant RDMA registration patterns on a GPU node.
Who can reach it
Local, low-privileged - a tenant process registering and tearing down ODP memory regions through libibverbs.
What to do
Upgrade the host kernel to 6.14 or a stable backport (6.12.13, 6.13.2). Rolling reboot of nodes where ODP is enabled.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.