CVE-2024-26858

What it actually does

Missing memory barrier allows compiler/CPU reordering of metadata map population and PTP WQ tracking in mlx5e_txwqe_complete, leaving the tracking list inconsistent and causing NULL pointer dereference in mlx5e_ptpsq_mark_ts_cqes_undelivered during NAPI polling.

Why it matters to the business

Kernel crashes or unpredictable behavior on systems using Mellanox mlx5 Ethernet adapters with PTP hardware timestamping, leading to network interface downtime and potential loss of precise time synchronization for applications.

How an attack unfolds

An attacker with local access triggers concurrent transmit completion and NAPI polling on an affected mlx5 interface under PTP workload; reordering populates the tracking list before the metadata map, resulting in a NULL dereference when the driver walks the list.

How to fix it

Update the Linux kernel to commit ffc253263a1375a65fa6c9f62a893e9767fbebfa or later; rebuild and reboot with the patched kernel. Disable hardware PTP timestamping on mlx5 interfaces if immediate patching is not possible.

How to confirm the fix worked

Confirm the running kernel contains commit ffc253263a1375a65fa6c9f62a893e9767fbebfa via git log or kernel version; exercise mlx5 PTP transmit paths under load and verify absence of NULL dereference panics in dmesg.

Typical attack path

1. Obtain local code execution or unprivileged user access on a host with mlx5e PTP-enabled NIC
2. Induce high-rate PTP timestamped transmit workloads while NAPI polling runs concurrently
3. Trigger the window where stores are reordered so tracking occurs before metadata population
4. Cause NAPI context to dereference uninitialized list entries leading to oops or panic

How to detect it

Inspect kernel logs for oops/panic messages containing mlx5e_ptpsq_mark_ts_cqes_undelivered or mlx5e_ptp; correlate with PTP-enabled mlx5 interface activity and recent transmit completion paths.

What your security team should do

• Prioritize kernel upgrade on all systems exposing mlx5 interfaces with PTP enabled
• Add the fixed commit hash to automated kernel build and deployment pipelines
• Monitor for oops reports referencing mlx5e_ptpsq_mark_ts_cqes_undelivered until patched
• Temporarily disable PTP hardware offload on mlx5 where feasible as a compensating control