GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-47694 (GCVE-0-2024-47694)

Vulnerability from cvelistv5 – Published: 2024-10-21 11:53 – Updated: 2026-05-11 20:38
VLAI
Title
IB/mlx5: Fix UMR pd cleanup on error flow of driver init
Summary
In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix UMR pd cleanup on error flow of driver init The cited commit moves the pd allocation from function mlx5r_umr_resource_cleanup() to a new function mlx5r_umr_cleanup(). So the fix in commit [1] is broken. In error flow, will hit panic [2]. Fix it by checking pd pointer to avoid panic if it is NULL; [1] RDMA/mlx5: Fix UMR cleanup on error flow of driver init [2] [ 347.567063] infiniband mlx5_0: Couldn't register device with driver model [ 347.591382] BUG: kernel NULL pointer dereference, address: 0000000000000020 [ 347.593438] #PF: supervisor read access in kernel mode [ 347.595176] #PF: error_code(0x0000) - not-present page [ 347.596962] PGD 0 P4D 0 [ 347.601361] RIP: 0010:ib_dealloc_pd_user+0x12/0xc0 [ib_core] [ 347.604171] RSP: 0018:ffff888106293b10 EFLAGS: 00010282 [ 347.604834] RAX: 0000000000000000 RBX: 000000000000000e RCX: 0000000000000000 [ 347.605672] RDX: ffff888106293ad0 RSI: 0000000000000000 RDI: 0000000000000000 [ 347.606529] RBP: 0000000000000000 R08: ffff888106293ae0 R09: ffff888106293ae0 [ 347.607379] R10: 0000000000000a06 R11: 0000000000000000 R12: 0000000000000000 [ 347.608224] R13: ffffffffa0704dc0 R14: 0000000000000001 R15: 0000000000000001 [ 347.609067] FS: 00007fdc720cd9c0(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 [ 347.610094] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 347.610727] CR2: 0000000000000020 CR3: 0000000103012003 CR4: 0000000000370eb0 [ 347.611421] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 347.612113] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 347.612804] Call Trace: [ 347.613130] <TASK> [ 347.613417] ? __die+0x20/0x60 [ 347.613793] ? page_fault_oops+0x150/0x3e0 [ 347.614243] ? free_msg+0x68/0x80 [mlx5_core] [ 347.614840] ? cmd_exec+0x48f/0x11d0 [mlx5_core] [ 347.615359] ? exc_page_fault+0x74/0x130 [ 347.615808] ? asm_exc_page_fault+0x22/0x30 [ 347.616273] ? ib_dealloc_pd_user+0x12/0xc0 [ib_core] [ 347.616801] mlx5r_umr_cleanup+0x23/0x90 [mlx5_ib] [ 347.617365] mlx5_ib_stage_pre_ib_reg_umr_cleanup+0x36/0x40 [mlx5_ib] [ 347.618025] __mlx5_ib_add+0x96/0xd0 [mlx5_ib] [ 347.618539] mlx5r_probe+0xe9/0x310 [mlx5_ib] [ 347.619032] ? kernfs_add_one+0x107/0x150 [ 347.619478] ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib] [ 347.619984] auxiliary_bus_probe+0x3e/0x90 [ 347.620448] really_probe+0xc5/0x3a0 [ 347.620857] __driver_probe_device+0x80/0x160 [ 347.621325] driver_probe_device+0x1e/0x90 [ 347.621770] __driver_attach+0xec/0x1c0 [ 347.622213] ? __device_attach_driver+0x100/0x100 [ 347.622724] bus_for_each_dev+0x71/0xc0 [ 347.623151] bus_add_driver+0xed/0x240 [ 347.623570] driver_register+0x58/0x100 [ 347.623998] __auxiliary_driver_register+0x6a/0xc0 [ 347.624499] ? driver_register+0xae/0x100 [ 347.624940] ? 0xffffffffa0893000 [ 347.625329] mlx5_ib_init+0x16a/0x1e0 [mlx5_ib] [ 347.625845] do_one_initcall+0x4a/0x2a0 [ 347.626273] ? gcov_event+0x2e2/0x3a0 [ 347.626706] do_init_module+0x8a/0x260 [ 347.627126] init_module_from_file+0x8b/0xd0 [ 347.627596] __x64_sys_finit_module+0x1ca/0x2f0 [ 347.628089] do_syscall_64+0x4c/0x100
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 13:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 638420115cc4ad6c3a2683bf46a052b505abb202 , < 99e2de5942b0390ddc24efada71edc6593e23f05 (git)
Affected: 638420115cc4ad6c3a2683bf46a052b505abb202 , < 112e6e83a894260cc7efe79a1fc47d4d51461742 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.11.2 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:05:28.995740Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:14:14.649Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/umr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "99e2de5942b0390ddc24efada71edc6593e23f05",
              "status": "affected",
              "version": "638420115cc4ad6c3a2683bf46a052b505abb202",
              "versionType": "git"
            },
            {
              "lessThan": "112e6e83a894260cc7efe79a1fc47d4d51461742",
              "status": "affected",
              "version": "638420115cc4ad6c3a2683bf46a052b505abb202",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/hw/mlx5/umr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mlx5: Fix UMR pd cleanup on error flow of driver init\n\nThe cited commit moves the pd allocation from function\nmlx5r_umr_resource_cleanup() to a new function mlx5r_umr_cleanup().\nSo the fix in commit [1] is broken. In error flow, will hit panic [2].\n\nFix it by checking pd pointer to avoid panic if it is NULL;\n\n[1] RDMA/mlx5: Fix UMR cleanup on error flow of driver init\n[2]\n [  347.567063] infiniband mlx5_0: Couldn\u0027t register device with driver model\n [  347.591382] BUG: kernel NULL pointer dereference, address: 0000000000000020\n [  347.593438] #PF: supervisor read access in kernel mode\n [  347.595176] #PF: error_code(0x0000) - not-present page\n [  347.596962] PGD 0 P4D 0\n [  347.601361] RIP: 0010:ib_dealloc_pd_user+0x12/0xc0 [ib_core]\n [  347.604171] RSP: 0018:ffff888106293b10 EFLAGS: 00010282\n [  347.604834] RAX: 0000000000000000 RBX: 000000000000000e RCX: 0000000000000000\n [  347.605672] RDX: ffff888106293ad0 RSI: 0000000000000000 RDI: 0000000000000000\n [  347.606529] RBP: 0000000000000000 R08: ffff888106293ae0 R09: ffff888106293ae0\n [  347.607379] R10: 0000000000000a06 R11: 0000000000000000 R12: 0000000000000000\n [  347.608224] R13: ffffffffa0704dc0 R14: 0000000000000001 R15: 0000000000000001\n [  347.609067] FS:  00007fdc720cd9c0(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000\n [  347.610094] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [  347.610727] CR2: 0000000000000020 CR3: 0000000103012003 CR4: 0000000000370eb0\n [  347.611421] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n [  347.612113] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n [  347.612804] Call Trace:\n [  347.613130]  \u003cTASK\u003e\n [  347.613417]  ? __die+0x20/0x60\n [  347.613793]  ? page_fault_oops+0x150/0x3e0\n [  347.614243]  ? free_msg+0x68/0x80 [mlx5_core]\n [  347.614840]  ? cmd_exec+0x48f/0x11d0 [mlx5_core]\n [  347.615359]  ? exc_page_fault+0x74/0x130\n [  347.615808]  ? asm_exc_page_fault+0x22/0x30\n [  347.616273]  ? ib_dealloc_pd_user+0x12/0xc0 [ib_core]\n [  347.616801]  mlx5r_umr_cleanup+0x23/0x90 [mlx5_ib]\n [  347.617365]  mlx5_ib_stage_pre_ib_reg_umr_cleanup+0x36/0x40 [mlx5_ib]\n [  347.618025]  __mlx5_ib_add+0x96/0xd0 [mlx5_ib]\n [  347.618539]  mlx5r_probe+0xe9/0x310 [mlx5_ib]\n [  347.619032]  ? kernfs_add_one+0x107/0x150\n [  347.619478]  ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib]\n [  347.619984]  auxiliary_bus_probe+0x3e/0x90\n [  347.620448]  really_probe+0xc5/0x3a0\n [  347.620857]  __driver_probe_device+0x80/0x160\n [  347.621325]  driver_probe_device+0x1e/0x90\n [  347.621770]  __driver_attach+0xec/0x1c0\n [  347.622213]  ? __device_attach_driver+0x100/0x100\n [  347.622724]  bus_for_each_dev+0x71/0xc0\n [  347.623151]  bus_add_driver+0xed/0x240\n [  347.623570]  driver_register+0x58/0x100\n [  347.623998]  __auxiliary_driver_register+0x6a/0xc0\n [  347.624499]  ? driver_register+0xae/0x100\n [  347.624940]  ? 0xffffffffa0893000\n [  347.625329]  mlx5_ib_init+0x16a/0x1e0 [mlx5_ib]\n [  347.625845]  do_one_initcall+0x4a/0x2a0\n [  347.626273]  ? gcov_event+0x2e2/0x3a0\n [  347.626706]  do_init_module+0x8a/0x260\n [  347.627126]  init_module_from_file+0x8b/0xd0\n [  347.627596]  __x64_sys_finit_module+0x1ca/0x2f0\n [  347.628089]  do_syscall_64+0x4c/0x100"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:38:57.334Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/99e2de5942b0390ddc24efada71edc6593e23f05"
        },
        {
          "url": "https://git.kernel.org/stable/c/112e6e83a894260cc7efe79a1fc47d4d51461742"
        }
      ],
      "title": "IB/mlx5: Fix UMR pd cleanup on error flow of driver init",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47694",
    "datePublished": "2024-10-21T11:53:32.611Z",
    "dateReserved": "2024-09-30T16:00:12.942Z",
    "dateUpdated": "2026-05-11T20:38:57.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47694",
      "date": "2026-09-17",
      "epss": "0.00202",
      "percentile": "0.10345"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47694\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T12:15:06.107\",\"lastModified\":\"2026-06-17T07:57:33.477\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nIB/mlx5: Fix UMR pd cleanup on error flow of driver init\\n\\nThe cited commit moves the pd allocation from function\\nmlx5r_umr_resource_cleanup() to a new function mlx5r_umr_cleanup().\\nSo the fix in commit [1] is broken. In error flow, will hit panic [2].\\n\\nFix it by checking pd pointer to avoid panic if it is NULL;\\n\\n[1] RDMA/mlx5: Fix UMR cleanup on error flow of driver init\\n[2]\\n [  347.567063] infiniband mlx5_0: Couldn\u0027t register device with driver model\\n [  347.591382] BUG: kernel NULL pointer dereference, address: 0000000000000020\\n [  347.593438] #PF: supervisor read access in kernel mode\\n [  347.595176] #PF: error_code(0x0000) - not-present page\\n [  347.596962] PGD 0 P4D 0\\n [  347.601361] RIP: 0010:ib_dealloc_pd_user+0x12/0xc0 [ib_core]\\n [  347.604171] RSP: 0018:ffff888106293b10 EFLAGS: 00010282\\n [  347.604834] RAX: 0000000000000000 RBX: 000000000000000e RCX: 0000000000000000\\n [  347.605672] RDX: ffff888106293ad0 RSI: 0000000000000000 RDI: 0000000000000000\\n [  347.606529] RBP: 0000000000000000 R08: ffff888106293ae0 R09: ffff888106293ae0\\n [  347.607379] R10: 0000000000000a06 R11: 0000000000000000 R12: 0000000000000000\\n [  347.608224] R13: ffffffffa0704dc0 R14: 0000000000000001 R15: 0000000000000001\\n [  347.609067] FS:  00007fdc720cd9c0(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000\\n [  347.610094] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n [  347.610727] CR2: 0000000000000020 CR3: 0000000103012003 CR4: 0000000000370eb0\\n [  347.611421] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n [  347.612113] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n [  347.612804] Call Trace:\\n [  347.613130]  \u003cTASK\u003e\\n [  347.613417]  ? __die+0x20/0x60\\n [  347.613793]  ? page_fault_oops+0x150/0x3e0\\n [  347.614243]  ? free_msg+0x68/0x80 [mlx5_core]\\n [  347.614840]  ? cmd_exec+0x48f/0x11d0 [mlx5_core]\\n [  347.615359]  ? exc_page_fault+0x74/0x130\\n [  347.615808]  ? asm_exc_page_fault+0x22/0x30\\n [  347.616273]  ? ib_dealloc_pd_user+0x12/0xc0 [ib_core]\\n [  347.616801]  mlx5r_umr_cleanup+0x23/0x90 [mlx5_ib]\\n [  347.617365]  mlx5_ib_stage_pre_ib_reg_umr_cleanup+0x36/0x40 [mlx5_ib]\\n [  347.618025]  __mlx5_ib_add+0x96/0xd0 [mlx5_ib]\\n [  347.618539]  mlx5r_probe+0xe9/0x310 [mlx5_ib]\\n [  347.619032]  ? kernfs_add_one+0x107/0x150\\n [  347.619478]  ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib]\\n [  347.619984]  auxiliary_bus_probe+0x3e/0x90\\n [  347.620448]  really_probe+0xc5/0x3a0\\n [  347.620857]  __driver_probe_device+0x80/0x160\\n [  347.621325]  driver_probe_device+0x1e/0x90\\n [  347.621770]  __driver_attach+0xec/0x1c0\\n [  347.622213]  ? __device_attach_driver+0x100/0x100\\n [  347.622724]  bus_for_each_dev+0x71/0xc0\\n [  347.623151]  bus_add_driver+0xed/0x240\\n [  347.623570]  driver_register+0x58/0x100\\n [  347.623998]  __auxiliary_driver_register+0x6a/0xc0\\n [  347.624499]  ? driver_register+0xae/0x100\\n [  347.624940]  ? 0xffffffffa0893000\\n [  347.625329]  mlx5_ib_init+0x16a/0x1e0 [mlx5_ib]\\n [  347.625845]  do_one_initcall+0x4a/0x2a0\\n [  347.626273]  ? gcov_event+0x2e2/0x3a0\\n [  347.626706]  do_init_module+0x8a/0x260\\n [  347.627126]  init_module_from_file+0x8b/0xd0\\n [  347.627596]  __x64_sys_finit_module+0x1ca/0x2f0\\n [  347.628089]  do_syscall_64+0x4c/0x100\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: IB/mlx5: Corregir limpieza de pd de UMR en flujo de error de inicializaci\u00f3n del controlador el commit citada mueve la asignaci\u00f3n de pd de la funci\u00f3n mlx5r_umr_resource_cleanup() a una nueva funci\u00f3n mlx5r_umr_cleanup(). Por lo tanto, la correcci\u00f3n en el commit [1] no funciona. En el flujo de error, se activar\u00e1 el p\u00e1nico [2]. Corr\u00edjalo comprobando el puntero pd para evitar el p\u00e1nico si es NULL; [1] RDMA/mlx5: Se corrige la limpieza de UMR en el flujo de error del inicio del controlador [2] [ 347.567063] infiniband mlx5_0: No se pudo registrar el dispositivo con el modelo del controlador [ 347.591382] ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000020 [ 347.593438] #PF: acceso de lectura del supervisor en modo kernel [ 347.595176] #PF: error_code(0x0000) - p\u00e1gina no presente [ 347.596962] PGD 0 P4D 0 [ 347.601361] RIP: 0010:ib_dealloc_pd_user+0x12/0xc0 [ib_core] [ 347.604171] RSP: 0018:ffff888106293b10 EFLAGS: 00010282 [ 347.604834] RAX: 0000000000000000 RBX: 000000000000000e RCX: 0000000000000000 [ 347.605672] RDX: ffff888106293ad0 RSI: 000000000000000 RDI: 000000000000000 [ 347.606529] RBP: 0000000000000000 R08: ffff888106293ae0 R09: ffff888106293ae0 [ 347.607379] R10: 0000000000000a06 R11: 0000000000000000 R12: 0000000000000000 [ 347.608224] R13: ffffffffa0704dc0 R14: 0000000000000001 R15: 0000000000000001 [ 347.609067] FS: 00007fdc720cd9c0(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 [ 347.610094] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 347.610727] CR2: 0000000000000020 CR3: 0000000103012003 CR4: 0000000000370eb0 [ 347.611421] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 347.612113] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 347.612804] Seguimiento de llamadas: [ 347.613130]  [ 347.613417] ? __die+0x20/0x60 [ 347.613793] ? page_fault_oops+0x150/0x3e0 [ 347.614243] ? free_msg+0x68/0x80 [mlx5_core] [ 347.614840] ? cmd_exec+0x48f/0x11d0 [mlx5_core] [ 347.615359] ? asm_exc_page_fault+0x22/0x30 [ 347.616273] ? kernfs_add_one+0x107/0x150 [347.619478] ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib] [ 347.619984] sonda_de_bus_auxiliar+0x3e/0x90 [ 347.620448] sonda_realmente+0xc5/0x3a0 [ 347.620857] __dispositivo_de_sonda_del_controlador+0x80/0x160 [ 347.621325] dispositivo_de_sonda_del_controlador+0x1e/0x90 [ 347.621770] __dispositivo_de_sonda_del_controlador+0xec/0x1c0 [ 347.622213] ? __controlador_de_conexi\u00f3n_de_dispositivo+0x100/0x100 [ 347.622724] bus_para_cada_dispositivo+0x71/0xc0 [ 347.623151] bus_agregar_controlador+0xed/0x240 [ 347.623570] registro_del_controlador+0x58/0x100 [ 347.623998] __registro_del_controlador_auxiliar+0x6a/0xc0 [ 347.624499] ? registro_del_controlador+0xae/0x100 [ 347.624940] ? 0xffffffffa0893000 [ 347.625329] mlx5_ib_init+0x16a/0x1e0 [mlx5_ib] [ 347.625845] hacer_una_llamada_inicia+0x4a/0x2a0 [ 347.626273] ? gcov_event+0x2e2/0x3a0 [ 347.626706] hacer_init_module+0x8a/0x260 [ 347.627126] iniciar_m\u00f3dulo_desde_archivo+0x8b/0xd0 [ 347.627596] __x64_sys_finit_module+0x1ca/0x2f0 [ 347.628089] hacer_syscall_64+0x4c/0x100\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/hw/mlx5/umr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"638420115cc4ad6c3a2683bf46a052b505abb202\",\"lessThan\":\"99e2de5942b0390ddc24efada71edc6593e23f05\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"638420115cc4ad6c3a2683bf46a052b505abb202\",\"lessThan\":\"112e6e83a894260cc7efe79a1fc47d4d51461742\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/hw/mlx5/umr.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.2\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-21T13:05:28.995740Z\",\"id\":\"CVE-2024-47694\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.2\",\"matchCriteriaId\":\"AB755D26-97F4-43B6-8604-CD076811E181\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/112e6e83a894260cc7efe79a1fc47d4d51461742\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/99e2de5942b0390ddc24efada71edc6593e23f05\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:22:56+00:00",
      "cve": "CVE-2024-47694",
      "id": "CVE-2024-47694",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: IB/mlx5: Fix UMR pd cleanup on error flow of driver init",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47694.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47694\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:05:28.995740Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:05:32.864Z\"}}], \"cna\": {\"title\": \"IB/mlx5: Fix UMR pd cleanup on error flow of driver init\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"638420115cc4ad6c3a2683bf46a052b505abb202\", \"lessThan\": \"99e2de5942b0390ddc24efada71edc6593e23f05\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"638420115cc4ad6c3a2683bf46a052b505abb202\", \"lessThan\": \"112e6e83a894260cc7efe79a1fc47d4d51461742\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/infiniband/hw/mlx5/umr.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/infiniband/hw/mlx5/umr.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/99e2de5942b0390ddc24efada71edc6593e23f05\"}, {\"url\": \"https://git.kernel.org/stable/c/112e6e83a894260cc7efe79a1fc47d4d51461742\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nIB/mlx5: Fix UMR pd cleanup on error flow of driver init\\n\\nThe cited commit moves the pd allocation from function\\nmlx5r_umr_resource_cleanup() to a new function mlx5r_umr_cleanup().\\nSo the fix in commit [1] is broken. In error flow, will hit panic [2].\\n\\nFix it by checking pd pointer to avoid panic if it is NULL;\\n\\n[1] RDMA/mlx5: Fix UMR cleanup on error flow of driver init\\n[2]\\n [  347.567063] infiniband mlx5_0: Couldn\u0027t register device with driver model\\n [  347.591382] BUG: kernel NULL pointer dereference, address: 0000000000000020\\n [  347.593438] #PF: supervisor read access in kernel mode\\n [  347.595176] #PF: error_code(0x0000) - not-present page\\n [  347.596962] PGD 0 P4D 0\\n [  347.601361] RIP: 0010:ib_dealloc_pd_user+0x12/0xc0 [ib_core]\\n [  347.604171] RSP: 0018:ffff888106293b10 EFLAGS: 00010282\\n [  347.604834] RAX: 0000000000000000 RBX: 000000000000000e RCX: 0000000000000000\\n [  347.605672] RDX: ffff888106293ad0 RSI: 0000000000000000 RDI: 0000000000000000\\n [  347.606529] RBP: 0000000000000000 R08: ffff888106293ae0 R09: ffff888106293ae0\\n [  347.607379] R10: 0000000000000a06 R11: 0000000000000000 R12: 0000000000000000\\n [  347.608224] R13: ffffffffa0704dc0 R14: 0000000000000001 R15: 0000000000000001\\n [  347.609067] FS:  00007fdc720cd9c0(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000\\n [  347.610094] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n [  347.610727] CR2: 0000000000000020 CR3: 0000000103012003 CR4: 0000000000370eb0\\n [  347.611421] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n [  347.612113] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n [  347.612804] Call Trace:\\n [  347.613130]  \u003cTASK\u003e\\n [  347.613417]  ? __die+0x20/0x60\\n [  347.613793]  ? page_fault_oops+0x150/0x3e0\\n [  347.614243]  ? free_msg+0x68/0x80 [mlx5_core]\\n [  347.614840]  ? cmd_exec+0x48f/0x11d0 [mlx5_core]\\n [  347.615359]  ? exc_page_fault+0x74/0x130\\n [  347.615808]  ? asm_exc_page_fault+0x22/0x30\\n [  347.616273]  ? ib_dealloc_pd_user+0x12/0xc0 [ib_core]\\n [  347.616801]  mlx5r_umr_cleanup+0x23/0x90 [mlx5_ib]\\n [  347.617365]  mlx5_ib_stage_pre_ib_reg_umr_cleanup+0x36/0x40 [mlx5_ib]\\n [  347.618025]  __mlx5_ib_add+0x96/0xd0 [mlx5_ib]\\n [  347.618539]  mlx5r_probe+0xe9/0x310 [mlx5_ib]\\n [  347.619032]  ? kernfs_add_one+0x107/0x150\\n [  347.619478]  ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib]\\n [  347.619984]  auxiliary_bus_probe+0x3e/0x90\\n [  347.620448]  really_probe+0xc5/0x3a0\\n [  347.620857]  __driver_probe_device+0x80/0x160\\n [  347.621325]  driver_probe_device+0x1e/0x90\\n [  347.621770]  __driver_attach+0xec/0x1c0\\n [  347.622213]  ? __device_attach_driver+0x100/0x100\\n [  347.622724]  bus_for_each_dev+0x71/0xc0\\n [  347.623151]  bus_add_driver+0xed/0x240\\n [  347.623570]  driver_register+0x58/0x100\\n [  347.623998]  __auxiliary_driver_register+0x6a/0xc0\\n [  347.624499]  ? driver_register+0xae/0x100\\n [  347.624940]  ? 0xffffffffa0893000\\n [  347.625329]  mlx5_ib_init+0x16a/0x1e0 [mlx5_ib]\\n [  347.625845]  do_one_initcall+0x4a/0x2a0\\n [  347.626273]  ? gcov_event+0x2e2/0x3a0\\n [  347.626706]  do_init_module+0x8a/0x260\\n [  347.627126]  init_module_from_file+0x8b/0xd0\\n [  347.627596]  __x64_sys_finit_module+0x1ca/0x2f0\\n [  347.628089]  do_syscall_64+0x4c/0x100\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"6.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:38:57.334Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47694\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:38:57.334Z\", \"dateReserved\": \"2024-09-30T16:00:12.942Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:32.611Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.