CVE-2021-47265

What it actually does

Missing validation of user-supplied port value when creating RDMA flow rules in the mlx5_ib driver allows an invalid value to reach internal structures, resulting in a NULL pointer dereference and kernel oops during _create_flow_rule.

Why it matters to the business

Systems using RDMA hardware can be crashed remotely or locally by unprivileged users, causing denial of service, unplanned downtime, and loss of availability for high-performance networking workloads.

How an attack unfolds

An attacker with access to InfiniBand verbs issues a crafted ib_uverbs_ex_create_flow request containing an out-of-range port; the missing check in mlx5_ib allows the invalid value to propagate into _create_flow_rule, dereferencing a NULL pointer and triggering a kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing commit 2f53c851eaf926767fbac62385615efd4886221c or later that adds port validation before flow rule creation; disable RDMA interfaces when not required.

How to confirm the fix worked

Confirm the presence of port-range checks inside mlx5_ib_create_flow and _create_flow_rule; test by attempting flow creation with port 0 and verifying the call is rejected before reaching the driver.

Typical attack path

1. Obtain local or RDMA network access to a vulnerable system
2. Open an RDMA device context via ib_uverbs
3. Craft an EX_CREATE_FLOW command with an invalid port number
4. Invoke the ioctl to trigger mlx5_ib_create_flow
5. Cause kernel oops and system instability

How to detect it

Search kernel logs and dmesg for call traces containing _create_flow_rule and mlx5_ib_create_flow; correlate with ib_uverbs ioctl entries around the time of crashes.

• _create_flow_rule+0x2d4/0xf28 [mlx5_ib]
• mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib]
• ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs]

What your security team should do

• Apply the upstream kernel fix immediately on all systems exposing RDMA
• Restrict unprivileged access to /dev/infiniband and RDMA sysfs entries
• Monitor kernel logs for mlx5_ib oops signatures
• Evaluate EPSS trend and ecosystem exposure to prioritize patching