AZL-88652
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-88652.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-88652
- Upstream
- Published
- 2026-05-27T14:17:14Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-45973 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix UMR hang in LAG error state unload
During firmware reset in LAG mode, a race condition causes the driver to hang indefinitely while waiting for UMR completion during device unload. See [1].
In LAG mode the bond device is only registered on the master, so it never sees sys_error events from the slave. During firmware reset this causes UMR waits to hang forever on unload as the slave is dead but the master hasn't entered error state yet, so UMR posts succeed but completions never arrive.
Fix this by adding a syserror notifier that gets registered before MLX5IBSTAGEIBREG and stays alive until after ibunregister_device(). This ensures error events reach the bond device throughout teardown.
[1] Call Trace: __schedule+0x2bd/0x760 schedule+0x37/0xa0 schedulepreemptdisabled+0xa/0x10 __mutex_lock.isra.6+0x2b5/0x4a0 __mlx5ibderegmr+0x606/0x870 [mlx5ib] ? __xaerase+0x4a/0xa0 ? condresched+0x15/0x30 ? waitforcompletion+0x31/0x100 ibderegmruser+0x48/0xc0 [ibcore] ? rdmacgunchargehierarchy+0xa0/0x100 destroyhwidruobject+0x20/0x50 [ibuverbs] uverbsdestroyuobject+0x37/0x150 [ibuverbs] __uverbscleanupufile+0xda/0x140 [ibuverbs] uverbsdestroyufilehw+0x3a/0xf0 [ibuverbs] ibuverbsremoveone+0xc3/0x140 [ibuverbs] removeclientcontext+0x8b/0xd0 [ibcore] disabledevice+0x8c/0x130 [ibcore] __ibunregisterdevice+0x10d/0x180 [ibcore] ibunregisterdevice+0x21/0x30 [ibcore] __mlx5ibremove+0x1e4/0x1f0 [mlx5ib] auxiliarybusremove+0x1e/0x30 devicereleasedriverinternal+0x103/0x1f0 busremovedevice+0xf7/0x170 devicedel+0x181/0x410 mlx5rescandriverslocked.part.10+0xa9/0x1d0 [mlx5core] mlx5disablelag+0x253/0x260 [mlx5core] mlx5lagdisablechange+0x89/0xc0 [mlx5core] mlx5eswitchdisable+0x67/0xa0 [mlx5core] mlx5unload+0x15/0xd0 [mlx5core] mlx5unloadone+0x71/0xc0 [mlx5core] mlx5syncresetreloadwork+0x83/0x100 [mlx5core] processonework+0x1a7/0x360 workerthread+0x30/0x390 ? createworker+0x1a0/0x1a0 kthread+0x116/0x130 ? kthreadflushworkfn+0x10/0x10 retfromfork+0x22/0x40
- References