Linux kernel mlx5_core firmware tracer (diag/fw_tracer): The firmware tracer took format strings directly from device

Impact

The firmware tracer took format strings directly from device firmware and passed them to kernel formatting with no validation. Malicious or compromised NIC/DPU firmware supplying %s, %p or %n reads arbitrary kernel memory. This is the clearest firmware-as-attacker case in the mlx5 stack, and it matters specifically for operators who accept hardware from third parties, run rented bare metal, or cannot fully attest NIC firmware provenance - the host kernel was trusting the device.

Who can reach it

Requires control of the NIC or DPU firmware image - a supply-chain or prior-tenant-persistence scenario on bare metal, or an attacker who already flashed the adapter. Not reachable from ordinary network traffic.

What to do

Upgrade the host kernel to 6.19 or a stable backport (5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.3) - the fix restricts the tracer to integer and hex specifiers. Rolling reboot. Pair it with the real control: enforce signed firmware and re-flash adapters to a known-good version between bare-metal tenants.

References