CVE-2021-47615

What it actually does

In the RDMA mlx5 driver, IB_MR_TYPE_DM user MRs lack a umem yet are misclassified as kernel MRs during deregistration, causing mlx5_free_priv_descs to access uninitialized union fields and attempt DMA unmap of never-allocated memory.

Why it matters to the business

Systems using InfiniBand or RoCE with mlx5 adapters may experience kernel warnings, crashes, or instability during memory region deregistration; the issue affects widely deployed Debian kernels and has been public for over two years without known exploitation.

How an attack unfolds

An attacker with local access or the ability to trigger RDMA operations issues a user-space MR deregistration command for an IB_MR_TYPE_DM region; this reaches mlx5_ib_dereg_mr, which incorrectly calls mlx5_free_priv_descs, resulting in debug_dma_unmap_page warnings or potential memory corruption.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.15.15-1 or later on Debian 12 and 13; rebuild and reboot affected systems after package installation.

How to confirm the fix worked

Confirm the running kernel version is at or above the fixed release; reproduce the MR deregistration flow in a test environment and verify absence of DMA unmap warnings in dmesg.

Typical attack path

1. Obtain local execution or RDMA user context on an affected mlx5 system
2. Allocate an IB_MR_TYPE_DM memory region via user verbs
3. Trigger deregistration path through ib_uverbs or equivalent
4. Observe kernel DMA debug warnings or system instability from unallocated memory release attempt

How to detect it

Search kernel logs for DMA-API warnings referencing mlx5_core and check_unmap or debug_dma_unmap_page during ib_uverbs or mlx5_ib activity; examine crash dumps for calls originating from mlx5_ib_dereg_mr.

What your security team should do

• Prioritize kernel package updates on all hosts with mlx5 RDMA hardware
• Schedule reboots to activate the patched kernel
• Review RDMA usage in production workloads for exposure
• Monitor vendor advisories for additional backported fixes