Linux kernel mlx5_core TX timeout devlink health reporter: The TX timeout recovery handler accesses the netdev pointer

Impact

The TX timeout recovery handler accesses the netdev pointer after the channel and its send queues have already been torn down and freed - a use-after-free in the code path that is supposed to recover the NIC from a stall. So the failure mode is: the NIC wedges under load, the recovery machinery fires, and instead of recovering it corrupts host kernel memory.

Who can reach it

Remote and unauthenticated in effect - an attacker who can drive enough traffic to induce a TX timeout on the mlx5 interface reaches the recovery path. No credentials on the host.

What to do

Upgrade the host kernel to a build carrying the fix (mainline 7.x and current stable series). Rolling reboot of the fleet. There is no useful config mitigation - you cannot safely turn off TX timeout recovery.

References