CVE-2024-38556

net/mlx5: Add a timeout to acquire the command queue semaphore

State: Published
Severity: 7.8 High
Published: Jun 19, 2024
Updated: Aug 5, 2026
Reserved: Jun 18, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Add a timeout to acquire the command queue semaphore

Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion.

Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8e715cd613a1e872b9d918e912d90b399785761a to before 4baae687a20ef2b82fde12de3c04461e6f2521d6Affected 8e715cd613a1e872b9d918e912d90b399785761a to before f9caccdd42e999b74303c9b0643300073ed5d319Affected 8e715cd613a1e872b9d918e912d90b399785761a to before 2d0962d05c93de391ce85f6e764df895f47c8918Affected 8e715cd613a1e872b9d918e912d90b399785761a to before 94024332a129c6e4275569d85c0c1bfb2ae2d71bAffected 8e715cd613a1e872b9d918e912d90b399785761a to before 485d65e1357123a697c591a5aeb773994b247ad7Affected 74dd45122b84479eee50bd0956ae8bc5799c9f8aAffected e801f81cee3c8901f52ee48c6329802b28fbb49cAffected d73d81447c6651904dd4a9e3fd88651ff174c1b7Affected 4646175c19fd019b773444a11ff62748eb83745bAffected 5.4.174 to before 5.5Affected 5.10.94 to before 5.11Affected 5.15.17 to before 5.16Affected 5.16.3 to before 5.17Affected
LinuxLinux	5.17Affected before 5.17Not affected 6.1.93 through 6.1.Not affected 6.6.33 through 6.6.Not affected 6.8.12 through 6.8.Not affected 6.9.3 through 6.9.Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

8e715cd613a1e872b9d918e912d90b399785761a to before 4baae687a20ef2b82fde12de3c04461e6f2521d6Affected
8e715cd613a1e872b9d918e912d90b399785761a to before f9caccdd42e999b74303c9b0643300073ed5d319Affected
8e715cd613a1e872b9d918e912d90b399785761a to before 2d0962d05c93de391ce85f6e764df895f47c8918Affected
8e715cd613a1e872b9d918e912d90b399785761a to before 94024332a129c6e4275569d85c0c1bfb2ae2d71bAffected
8e715cd613a1e872b9d918e912d90b399785761a to before 485d65e1357123a697c591a5aeb773994b247ad7Affected
74dd45122b84479eee50bd0956ae8bc5799c9f8aAffected
e801f81cee3c8901f52ee48c6329802b28fbb49cAffected
d73d81447c6651904dd4a9e3fd88651ff174c1b7Affected
4646175c19fd019b773444a11ff62748eb83745bAffected
5.4.174 to before 5.5Affected
5.10.94 to before 5.11Affected
5.15.17 to before 5.16Affected
5.16.3 to before 5.17Affected

LinuxLinux

5.17Affected
before 5.17Not affected
6.1.93 through 6.1.*Not affected
6.6.33 through 6.6.*Not affected
6.8.12 through 6.8.*Not affected
6.9.3 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.