CVE-2024-38555: net/mlx5: Discard command completions in internal error

Published Jun 19, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Discard command completions in internal error

Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually.

Kernel log: ------------[ cut here ]------------ refcountt: underflow; use-after-free. ... RIP: 0010:refcountwarnsaturate+0xd8/0xe0 ... Call Trace: <IRQ> ? warn+0x79/0x120 ? refcountwarnsaturate+0xd8/0xe0 ? reportbug+0x17c/0x190 ? handlebug+0x3c/0x60 ? excinvalidop+0x14/0x70 ? asmexcinvalidop+0x16/0x20 ? refcountwarnsaturate+0xd8/0xe0 cmdentput+0x13b/0x160 [mlx5core] mlx5cmdcomphandler+0x5f9/0x670 [mlx5core] cmdcompnotifier+0x1f/0x30 [mlx5core] notifiercallchain+0x35/0xb0 atomicnotifiercallchain+0x16/0x20 mlx5eqasyncint+0xf6/0x290 [mlx5core] notifiercallchain+0x35/0xb0 atomicnotifiercallchain+0x16/0x20 irqinthandler+0x19/0x30 [mlx5core] handleirqeventpercpu+0x4b/0x160 handleirqevent+0x2e/0x80 handleedgeirq+0x98/0x230 commoninterrupt+0x3b/0xa0 commoninterrupt+0x7b/0xa0 </IRQ> <TASK> asmcommoninterrupt+0x22/0x40

Other sources

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Discard command completions in internal error

The Linux kernel CVE team has assigned CVE-2024-38555 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024061952-CVE-2024-38555-aefb@gregkh/T

Red Hat

Linux Kernel is vulnerable to a denial of service, caused by a use-after-free flaw when FW completion arrives while device is in internal error state. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.

IBM

Affected Software

18 affected componentsFixes available
Linux Linux kernel>=5.10.20<5.10.219
Linux Linux kernel>=5.12<5.15.161
Linux Linux kernel>=5.16<6.1.93
Linux Linux kernel>=6.2<6.6.33
Linux Linux kernel>=6.7<6.8.12
Linux Linux kernel>=6.9<6.9.3
IBM Security Verify Governance<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Software Stack<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Virtual Appliance<=ISVG 10.0.2
IBM Security Verify Governance Identity Manager Container<=ISVG 10.0.2
redhat/kernel<5.10.219
5.10.219
redhat/kernel<5.15.161
5.15.161
redhat/kernel<6.1.93
6.1.93
redhat/kernel<6.6.33
6.6.33
redhat/kernel<6.8.12
6.8.12
redhat/kernel<6.9.3
6.9.3
redhat/kernel<6.10
6.10
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-16.12.27-1

Event History

Jun 19, 2024
CVE Published
via MITRE·01:35 PM
Data Sourced
via MITRE·01:35 PM
Description
Jun 20, 2024
Data Sourced
via Red Hat·05:23 PM
DescriptionSeverityAffected Software
Aug 8, 2024
Data Sourced
via Launchpad·11:29 PM
Description
Apr 27, 2025
Data Sourced
via Ubuntu·12:29 AM
RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-38555?

CVE-2024-38555 is classified with a severity level that indicates a significant risk due to a use after free issue in the Linux kernel.

2

How do I fix CVE-2024-38555?

To fix CVE-2024-38555, update the kernel to versions 5.10.219, 5.15.161, 6.1.93, or later versions as specified by your distribution.

3

Which Linux kernel versions are affected by CVE-2024-38555?

CVE-2024-38555 affects various kernel versions prior to 5.10.219, 5.15.161, 6.1.93, and other specific versions from different vendor releases.

4

What is the nature of the vulnerability described in CVE-2024-38555?

The vulnerability in CVE-2024-38555 involves a use after free condition triggered by command completions arriving while the device is in an internal error state.

5

Is there an exploit for CVE-2024-38555?

While no specific exploits have been publicly disclosed for CVE-2024-38555, the nature of the vulnerability poses a risk that could potentially be exploited.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203