CVE-2024-53121

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: fs, lock FTE when checking if active

The referenced commits introduced a two-step process for deleting FTEs:

- Lock the FTE, delete it from hardware, set the hardware deletion function

to NULL and unlock the FTE.

- Lock the parent flow group, delete the software copy of the FTE, and

remove it from the xarray.

However, this approach encounters a race condition if a rule with the same

match value is added simultaneously. In this scenario, fs_core may set the

hardware deletion function to NULL prematurely, causing a panic during

subsequent rule deletions.

To prevent this, ensure the active flag of the FTE is checked under a lock,

which will prevent the fs_core layer from attaching a new steering rule to

an FTE that is in the process of deletion.

[ 438.967589] MOSHE: 2496 mlx5_del_flow_rules del_hw_func

[ 438.968205] ------------[ cut here ]------------

[ 438.968654] refcount_t: decrement hit 0; leak

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References