CVE-2024-44970

What it actually does

Double unlink of the same WQE from the mlx5 WQ linked list (mlx5_wq_ll_pop) when SHAMPO produces CQEs reporting zero consumed strides after the WQE has already been fully consumed and removed, resulting in linked-list corruption.

Why it matters to the business

Systems using Mellanox ConnectX adapters with SHAMPO may experience kernel instability, crashes, or degraded network performance; the issue affects widely deployed Linux distributions and downstream packages, increasing operational risk until kernels are updated.

How an attack unfolds

An attacker with the ability to generate network traffic that exercises the SHAMPO receive path can cause the driver to emit repeated CQEs with zero consumed strides for a fully consumed WQE, triggering the second unlink and corrupting the work-queue list; named espionage and financially motivated actors have been observed exploiting similar Linux kernel memory-corruption issues.

How to fix it

Upgrade the Linux kernel to a version containing commit 7b379353e9144e1f7460ff15f39862012c9d0d78 or later; rebuild and reboot with the patched kernel; for packaged distributions apply the vendor backport that includes the SHAMPO zero-stride guard.

How to confirm the fix worked

Confirm the running kernel contains commit 7b379353e9144e1f7460ff15f39862012c9d0d78; verify mlx5e driver initialization logs no longer contain the vulnerable unlink path; run regression tests that exercise SHAMPO receive workloads and monitor for list corruption warnings.

Typical attack path

1. Identify hosts with mlx5e SHAMPO enabled
2. Send crafted or high-rate receive traffic that triggers zero-stride CQEs after WQE exhaustion
3. Trigger the double-unlink path in mlx5_wq_ll_pop
4. Corrupt the WQ linked list leading to memory corruption or crash

How to detect it

Search kernel logs and crash dumps for repeated calls to mlx5_wq_ll_pop on the same WQE, list corruption warnings, or mlx5e SHAMPO receive-path oops; review auditd and dmesg for unusual network driver faults around the time of any system instability.

• mlx5_wq_ll_pop
• SHAMPO.*consumed strides
• WQ linked list corruption

What your security team should do

• Apply the fixed kernel commit 7b379353e9144e1f7460ff15f39862012c9d0d78 or equivalent vendor update immediately on all systems with mlx5e hardware
• Prioritize patching internet-facing or high-value hosts first given observed exploitation of similar kernel memory issues
• Disable SHAMPO if the feature is not required until the update can be deployed
• Update monitoring rules to detect mlx5 WQ list corruption symptoms