CVE-2024-35961

What it actually does

The mlx5 driver invokes devlink health reporting before devlink_register under certain non-fatal FW error paths during probe, violating the expected lock ordering and triggering a WARN_ON in devlink_recover_notify.

Why it matters to the business

Spurious kernel warnings on systems using affected mlx5 network adapters during device initialization under transient firmware conditions, potentially complicating troubleshooting and indicating possible future stability issues in high-availability environments.

How an attack unfolds

No attacker exploitation is possible; the flaw only produces an incorrect warning when a non-fatal firmware error occurs during mlx5 probe before devlink registration completes. The provided threat actor reference does not apply to this kernel ordering issue.

How to fix it

Update the Linux kernel to a version containing commit 8c91c60858473731bcdaf04fda99fcbcf84420d4 or later; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Verify the running kernel git commit or version contains 8c91c60858473731bcdaf04fda99fcbcf84420d4; trigger a non-fatal FW error path during mlx5 probe and confirm absence of the devlink_recover_notify WARN_ON.

Typical attack path

1. Load mlx5_core module on hardware experiencing a non-fatal FW error during probe
2. mlx5_fw_reporter_err_work schedules devlink_health_report before devl_register completes
3. devlink_recover_notify triggers WARN_ON due to missing prior registration under the devlink lock

How to detect it

Search kernel logs and dmesg for the stack trace containing devlink_recover_notify.constprop.0 and mlx5_fw_reporter_err_work; correlate with mlx5 probe events on systems running unpatched kernels.

What your security team should do

• Prioritize kernel upgrade on all systems using mlx5 adapters within standard change windows
• Monitor kernel logs for devlink health reports from mlx5 during boot until patched
• Review downstream distributions for backported fixes of the referenced commit