CVE-2024-44970

MEDIUM

Linux Kernel - Use-After-Free in mlx5e SHAMPO WQ Linked List Handling

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink When all the strides in a WQE have been consumed, the WQE is unlinked from the WQ linked list (mlx5_wq_ll_pop()). For SHAMPO, it is possible to receive CQEs with 0 consumed strides for the same WQE even after the WQE is fully consumed and unlinked. This triggers an additional unlink for the same wqe which corrupts the linked list. Fix this scenario by accepting 0 sized consumed strides without unlinking the WQE again.

Scores

CVSS v3 5.5
EPSS 0.0021
EPSS Percentile 11.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (14)
linux/Kernel 5.16.0 - 6.1.105linux
linux/Kernel 6.2.0 - 6.6.46linux
linux/Kernel 6.7.0 - 6.10.5linux
Linux/Linux < 5.16
Linux/Linux 5.16
Linux/Linux 6.1.105 - 6.1.*
Linux/Linux 6.10.5 - 6.10.*
Linux/Linux 6.11
Linux/Linux 6.6.46 - 6.6.*
Linux/Linux f97d5c2a453e26071e3b0ec12161de57c4a237c4 - 50d8009a0ac02c3311b23a0066511f8337bd88d9
... and 4 more
Published Sep 04, 2024
Tracked Since Feb 18, 2026