CVE-2024-43866

What it actually does

Race condition in mlx5 health work handling during device shutdown allows a started health work item to race with shutdown, leading to potential NULL pointer dereference.

Why it matters to the business

Systems using affected mlx5 network hardware may experience kernel instability or crashes specifically during device removal or system shutdown sequences, increasing operational risk in environments with frequent hardware reconfiguration.

How an attack unfolds

An attacker with local access triggers mlx5 device shutdown while concurrently initiating health recovery work; the absence of proper draining allows the work item to execute after critical structures are torn down, resulting in a NULL pointer access.

How to fix it

Update the Linux kernel to the fixed commit 5005e2e159b300c1b8c6820a1e13a62eb0127b9b or later stable releases containing the always-drain-health change in the mlx5 shutdown callback.

How to confirm the fix worked

Confirm the presence of the drain health WQ call in the shutdown callback path in the running kernel source or verify the commit is included via kernel version or git log checks.

Typical attack path

1. Obtain local access on a system with mlx5 hardware
2. Trigger device shutdown or removal path
3. Force concurrent health work scheduling
4. Observe NULL pointer dereference during shutdown callback

How to detect it

Review kernel logs for NULL pointer dereference traces involving mlx5 health work during shutdown events; check for recent device removal or shutdown activity coinciding with crashes.

What your security team should do

• Prioritize kernel updates on systems with mlx5 devices
• Monitor for any downstream package updates in distributions
• Test shutdown paths in lab environments before production rollout