Vulnerability-Lookup

CVE-2024-38555 (GCVE-0-2024-38555)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-08-05 11:32

Title

net/mlx5: Discard command completions in internal error

Summary

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Discard command completions in internal error Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually. Kernel log: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: <IRQ> ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0xa0 common_interrupt+0x7b/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 17:14 UTC

Assigner

Linux mitre root

References

7 references

URL	Tags
https://git.kernel.org/stable/c/f6fbb8535e990f844…
https://git.kernel.org/stable/c/3cb92b0ad73d3f173…
https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3…
https://git.kernel.org/stable/c/1337ec94bc5a9eed2…
https://git.kernel.org/stable/c/1d5dce5e92a70274d…
https://git.kernel.org/stable/c/7ac4c69c34240c6de…
https://git.kernel.org/stable/c/db9b31aa9bc56ff0d…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 27c79b3a9212cf4ba634c157e07d29548181a208 , < f6fbb8535e990f844371086ab2c1221f71f993d3 (git) Affected: 51d138c2610a236c1ed0059d034ee4c74f452b86 , < 3cb92b0ad73d3f1734e812054e698d655e9581b0 (git) Affected: 51d138c2610a236c1ed0059d034ee4c74f452b86 , < bf8aaf0ae01c27ae3c06aa8610caf91e50393396 (git) Affected: 51d138c2610a236c1ed0059d034ee4c74f452b86 , < 1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb (git) Affected: 51d138c2610a236c1ed0059d034ee4c74f452b86 , < 1d5dce5e92a70274de67a59e1e674c3267f94cd7 (git) Affected: 51d138c2610a236c1ed0059d034ee4c74f452b86 , < 7ac4c69c34240c6de820492c0a28a0bd1494265a (git) Affected: 51d138c2610a236c1ed0059d034ee4c74f452b86 , < db9b31aa9bc56ff0d15b78f7e827d61c4a096e40 (git) Affected: 2e5d24b3bf091802c5456dc8f8f6a6be4493c8ca (git) Affected: 5.10.20 , < 5.10.219 (semver) Affected: 5.11.3 , < 5.12 (semver)	guessed
Linux	Linux	Affected: 5.12 Unaffected: 0 , < 5.12 (semver) Unaffected: 5.10.219 , ≤ 5.10.* (semver) Unaffected: 5.15.161 , ≤ 5.15.* (semver) Unaffected: 6.1.93 , ≤ 6.1.* (semver) Unaffected: 6.6.33 , ≤ 6.6.* (semver) Unaffected: 6.8.12 , ≤ 6.8.* (semver) Unaffected: 6.9.3 , ≤ 6.9.* (semver) Unaffected: 6.10 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.241Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38555",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:14:41.121534Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:56.983Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6fbb8535e990f844371086ab2c1221f71f993d3",
              "status": "affected",
              "version": "27c79b3a9212cf4ba634c157e07d29548181a208",
              "versionType": "git"
            },
            {
              "lessThan": "3cb92b0ad73d3f1734e812054e698d655e9581b0",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "bf8aaf0ae01c27ae3c06aa8610caf91e50393396",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "1d5dce5e92a70274de67a59e1e674c3267f94cd7",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "7ac4c69c34240c6de820492c0a28a0bd1494265a",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "db9b31aa9bc56ff0d15b78f7e827d61c4a096e40",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2e5d24b3bf091802c5456dc8f8f6a6be4493c8ca",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.219",
              "status": "affected",
              "version": "5.10.20",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "5.10.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Discard command completions in internal error\n\nFix use after free when FW completion arrives while device is in\ninternal error state. Avoid calling completion handler in this case,\nsince the device will flush the command interface and trigger all\ncompletions manually.\n\nKernel log:\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\n...\nRIP: 0010:refcount_warn_saturate+0xd8/0xe0\n...\nCall Trace:\n\u003cIRQ\u003e\n? __warn+0x79/0x120\n? refcount_warn_saturate+0xd8/0xe0\n? report_bug+0x17c/0x190\n? handle_bug+0x3c/0x60\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? refcount_warn_saturate+0xd8/0xe0\ncmd_ent_put+0x13b/0x160 [mlx5_core]\nmlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core]\ncmd_comp_notifier+0x1f/0x30 [mlx5_core]\nnotifier_call_chain+0x35/0xb0\natomic_notifier_call_chain+0x16/0x20\nmlx5_eq_async_int+0xf6/0x290 [mlx5_core]\nnotifier_call_chain+0x35/0xb0\natomic_notifier_call_chain+0x16/0x20\nirq_int_handler+0x19/0x30 [mlx5_core]\n__handle_irq_event_percpu+0x4b/0x160\nhandle_irq_event+0x2e/0x80\nhandle_edge_irq+0x98/0x230\n__common_interrupt+0x3b/0xa0\ncommon_interrupt+0x7b/0xa0\n\u003c/IRQ\u003e\n\u003cTASK\u003e\nasm_common_interrupt+0x22/0x40"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the mlx5 PCI command/EQ interface; it is driven by locally issued firmware commands (RDMA uverbs, netdev/flow configuration) and the device health path, not by any remotely supplied data. No network packet reaches `cmd_comp_notifier()`.\nAC:H - Exploitation requires the device to be in `MLX5_DEVICE_STATE_INTERNAL_ERROR` \u2014 set only by a fatal FW syndrome, a PCI/AER error, or an admin-initiated FW sync reset \u2014 and a real FW completion must land in the window during/after `mlx5_cmd_flush()`; the attacker can flood the command queue to widen the window but cannot induce the error transition itself.\nPR:L - An unprivileged local user can supply the attacker-controlled half \u2014 keeping firmware commands in flight via the RDMA character device (commonly mode 0666 under rdma-core udev rules) and spraying `kmalloc-512` to reoccupy the freed `mlx5_cmd_work_ent`. No capability is needed for those operations.\nUI:N - The double `cmd_ent_put()` fires from the async EQ interrupt handler with no victim action involved; the attacker only needs to have commands outstanding when the device faults.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - After the entry is freed, `ent-\u003eout`, `ent-\u003elay` and `ent-\u003euout` are read from reallocated memory and `mlx5_copy_from_msg()` copies firmware response data through those attacker-groomable pointers, giving an arbitrary kernel read/disclosure primitive.\nI:H - The stale completion path performs `callback(err, context)` \u2014 an indirect call through a function pointer read out of freed memory \u2014 plus writes via `ent-\u003eout`/`ent-\u003euout` and `mlx5_free_cmd_msg()`/`free_msg()` on freed pointers, yielding arbitrary write and control-flow hijack primitives.\nA:H - The reported symptom is a `refcount_t: underflow; use-after-free` WARN in hard-IRQ context (fatal under panic_on_warn); the extra put also frees a live command entry and corrupts the command-slot bitmask and semaphore, leading to oops/panic and a wedged command interface."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:45.063Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396"
        },
        {
          "url": "https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a"
        },
        {
          "url": "https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40"
        }
      ],
      "title": "net/mlx5: Discard command completions in internal error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38555",
    "datePublished": "2024-06-19T13:35:26.059Z",
    "dateReserved": "2024-06-18T19:36:34.920Z",
    "dateUpdated": "2026-08-05T11:32:45.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38555",
      "date": "2026-09-16",
      "epss": "0.00261",
      "percentile": "0.18033"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.10.20\", \"versionEndExcluding\": \"5.10.219\", \"matchCriteriaId\": \"12848580-6A3F-4069-9B0A-78AAA5E79BE7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.12\", \"versionEndExcluding\": \"5.15.161\", \"matchCriteriaId\": \"A5A5A54E-7208-43CC-811F-57A4B7A4488D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.93\", \"matchCriteriaId\": \"EEFB78EE-F990-4197-BF1C-156760A55667\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.33\", \"matchCriteriaId\": \"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.8.12\", \"matchCriteriaId\": \"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.9\", \"versionEndExcluding\": \"6.9.3\", \"matchCriteriaId\": \"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Discard command completions in internal error\\n\\nFix use after free when FW completion arrives while device is in\\ninternal error state. Avoid calling completion handler in this case,\\nsince the device will flush the command interface and trigger all\\ncompletions manually.\\n\\nKernel log:\\n------------[ cut here ]------------\\nrefcount_t: underflow; use-after-free.\\n...\\nRIP: 0010:refcount_warn_saturate+0xd8/0xe0\\n...\\nCall Trace:\\n\u003cIRQ\u003e\\n? __warn+0x79/0x120\\n? refcount_warn_saturate+0xd8/0xe0\\n? report_bug+0x17c/0x190\\n? handle_bug+0x3c/0x60\\n? exc_invalid_op+0x14/0x70\\n? asm_exc_invalid_op+0x16/0x20\\n? refcount_warn_saturate+0xd8/0xe0\\ncmd_ent_put+0x13b/0x160 [mlx5_core]\\nmlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core]\\ncmd_comp_notifier+0x1f/0x30 [mlx5_core]\\nnotifier_call_chain+0x35/0xb0\\natomic_notifier_call_chain+0x16/0x20\\nmlx5_eq_async_int+0xf6/0x290 [mlx5_core]\\nnotifier_call_chain+0x35/0xb0\\natomic_notifier_call_chain+0x16/0x20\\nirq_int_handler+0x19/0x30 [mlx5_core]\\n__handle_irq_event_percpu+0x4b/0x160\\nhandle_irq_event+0x2e/0x80\\nhandle_edge_irq+0x98/0x230\\n__common_interrupt+0x3b/0xa0\\ncommon_interrupt+0x7b/0xa0\\n\u003c/IRQ\u003e\\n\u003cTASK\u003e\\nasm_common_interrupt+0x22/0x40\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: descartar la finalizaci\\u00f3n de comandos en caso de error interno. Se corrige el use-after-free cuando llega la finalizaci\\u00f3n del FW mientras el dispositivo est\\u00e1 en estado de error interno. Evite llamar al controlador de finalizaci\\u00f3n en este caso, ya que el dispositivo limpiar\\u00e1 la interfaz de comando y activar\\u00e1 todas las finalizaciones manualmente. Registro del kernel: ------------[ cortar aqu\\u00ed ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Seguimiento de llamadas: ? __advertir+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0? report_bug+0x17c/0x190? handle_bug+0x3c/0x60? exc_invalid_op+0x14/0x70? asm_exc_invalid_op+0x16/0x20? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 cadena+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35 /0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0 xa0 interrupci\\u00f3n_com\\u00fan+0x7b/0xa0   asm_interrupci\\u00f3n_com\\u00fan+0x22 /0x40\"}]",
      "id": "CVE-2024-38555",
      "lastModified": "2024-11-21T09:26:20.137",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-06-19T14:15:15.720",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38555\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:15.720\",\"lastModified\":\"2026-08-04T11:18:43.583\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Discard command completions in internal error\\n\\nFix use after free when FW completion arrives while device is in\\ninternal error state. Avoid calling completion handler in this case,\\nsince the device will flush the command interface and trigger all\\ncompletions manually.\\n\\nKernel log:\\n------------[ cut here ]------------\\nrefcount_t: underflow; use-after-free.\\n...\\nRIP: 0010:refcount_warn_saturate+0xd8/0xe0\\n...\\nCall Trace:\\n\u003cIRQ\u003e\\n? __warn+0x79/0x120\\n? refcount_warn_saturate+0xd8/0xe0\\n? report_bug+0x17c/0x190\\n? handle_bug+0x3c/0x60\\n? exc_invalid_op+0x14/0x70\\n? asm_exc_invalid_op+0x16/0x20\\n? refcount_warn_saturate+0xd8/0xe0\\ncmd_ent_put+0x13b/0x160 [mlx5_core]\\nmlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core]\\ncmd_comp_notifier+0x1f/0x30 [mlx5_core]\\nnotifier_call_chain+0x35/0xb0\\natomic_notifier_call_chain+0x16/0x20\\nmlx5_eq_async_int+0xf6/0x290 [mlx5_core]\\nnotifier_call_chain+0x35/0xb0\\natomic_notifier_call_chain+0x16/0x20\\nirq_int_handler+0x19/0x30 [mlx5_core]\\n__handle_irq_event_percpu+0x4b/0x160\\nhandle_irq_event+0x2e/0x80\\nhandle_edge_irq+0x98/0x230\\n__common_interrupt+0x3b/0xa0\\ncommon_interrupt+0x7b/0xa0\\n\u003c/IRQ\u003e\\n\u003cTASK\u003e\\nasm_common_interrupt+0x22/0x40\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: descartar la finalizaci\u00f3n de comandos en caso de error interno. Se corrige el use-after-free cuando llega la finalizaci\u00f3n del FW mientras el dispositivo est\u00e1 en estado de error interno. Evite llamar al controlador de finalizaci\u00f3n en este caso, ya que el dispositivo limpiar\u00e1 la interfaz de comando y activar\u00e1 todas las finalizaciones manualmente. Registro del kernel: ------------[ cortar aqu\u00ed ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Seguimiento de llamadas: ? __advertir+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0? report_bug+0x17c/0x190? handle_bug+0x3c/0x60? exc_invalid_op+0x14/0x70? asm_exc_invalid_op+0x16/0x20? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 cadena+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35 /0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0 xa0 interrupci\u00f3n_com\u00fan+0x7b/0xa0   asm_interrupci\u00f3n_com\u00fan+0x22 /0x40\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/cmd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"27c79b3a9212cf4ba634c157e07d29548181a208\",\"lessThan\":\"f6fbb8535e990f844371086ab2c1221f71f993d3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51d138c2610a236c1ed0059d034ee4c74f452b86\",\"lessThan\":\"3cb92b0ad73d3f1734e812054e698d655e9581b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51d138c2610a236c1ed0059d034ee4c74f452b86\",\"lessThan\":\"bf8aaf0ae01c27ae3c06aa8610caf91e50393396\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51d138c2610a236c1ed0059d034ee4c74f452b86\",\"lessThan\":\"1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51d138c2610a236c1ed0059d034ee4c74f452b86\",\"lessThan\":\"1d5dce5e92a70274de67a59e1e674c3267f94cd7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51d138c2610a236c1ed0059d034ee4c74f452b86\",\"lessThan\":\"7ac4c69c34240c6de820492c0a28a0bd1494265a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"51d138c2610a236c1ed0059d034ee4c74f452b86\",\"lessThan\":\"db9b31aa9bc56ff0d15b78f7e827d61c4a096e40\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2e5d24b3bf091802c5456dc8f8f6a6be4493c8ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.20\",\"lessThan\":\"5.10.219\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.11.3\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/cmd.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.219\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.161\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.93\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.33\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.12\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.3\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:14:41.121534Z\",\"id\":\"CVE-2024-38555\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.20\",\"versionEndExcluding\":\"5.10.219\",\"matchCriteriaId\":\"12848580-6A3F-4069-9B0A-78AAA5E79BE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.12\",\"versionEndExcluding\":\"5.15.161\",\"matchCriteriaId\":\"A5A5A54E-7208-43CC-811F-57A4B7A4488D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"EEFB78EE-F990-4197-BF1C-156760A55667\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:57:12+00:00",
      "cve": "CVE-2024-38555",
      "id": "CVE-2024-38555",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:fixed": "1210",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "30",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: Discard command completions in internal error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38555.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:11:09Z",
      "cve": "CVE-2024-38555",
      "id": "CVE-2024-38555",
      "initial_release_date": "2024-06-21T03:06:23Z",
      "product_status:known_affected": "352",
      "product_status:known_not_affected": "225",
      "product_status:recommended": "766",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-38555",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-38555.json",
      "version": "87"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:25.241Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38555\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:14:41.121534Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:27.084Z\"}}], \"cna\": {\"title\": \"net/mlx5: Discard command completions in internal error\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"27c79b3a9212cf4ba634c157e07d29548181a208\", \"lessThan\": \"f6fbb8535e990f844371086ab2c1221f71f993d3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"51d138c2610a236c1ed0059d034ee4c74f452b86\", \"lessThan\": \"3cb92b0ad73d3f1734e812054e698d655e9581b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"51d138c2610a236c1ed0059d034ee4c74f452b86\", \"lessThan\": \"bf8aaf0ae01c27ae3c06aa8610caf91e50393396\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"51d138c2610a236c1ed0059d034ee4c74f452b86\", \"lessThan\": \"1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"51d138c2610a236c1ed0059d034ee4c74f452b86\", \"lessThan\": \"1d5dce5e92a70274de67a59e1e674c3267f94cd7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"51d138c2610a236c1ed0059d034ee4c74f452b86\", \"lessThan\": \"7ac4c69c34240c6de820492c0a28a0bd1494265a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"51d138c2610a236c1ed0059d034ee4c74f452b86\", \"lessThan\": \"db9b31aa9bc56ff0d15b78f7e827d61c4a096e40\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"2e5d24b3bf091802c5456dc8f8f6a6be4493c8ca\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.20\", \"lessThan\": \"5.10.219\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.11.3\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/cmd.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/cmd.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3\"}, {\"url\": \"https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0\"}, {\"url\": \"https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396\"}, {\"url\": \"https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb\"}, {\"url\": \"https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7\"}, {\"url\": \"https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a\"}, {\"url\": \"https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5: Discard command completions in internal error\\n\\nFix use after free when FW completion arrives while device is in\\ninternal error state. Avoid calling completion handler in this case,\\nsince the device will flush the command interface and trigger all\\ncompletions manually.\\n\\nKernel log:\\n------------[ cut here ]------------\\nrefcount_t: underflow; use-after-free.\\n...\\nRIP: 0010:refcount_warn_saturate+0xd8/0xe0\\n...\\nCall Trace:\\n\u003cIRQ\u003e\\n? __warn+0x79/0x120\\n? refcount_warn_saturate+0xd8/0xe0\\n? report_bug+0x17c/0x190\\n? handle_bug+0x3c/0x60\\n? exc_invalid_op+0x14/0x70\\n? asm_exc_invalid_op+0x16/0x20\\n? refcount_warn_saturate+0xd8/0xe0\\ncmd_ent_put+0x13b/0x160 [mlx5_core]\\nmlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core]\\ncmd_comp_notifier+0x1f/0x30 [mlx5_core]\\nnotifier_call_chain+0x35/0xb0\\natomic_notifier_call_chain+0x16/0x20\\nmlx5_eq_async_int+0xf6/0x290 [mlx5_core]\\nnotifier_call_chain+0x35/0xb0\\natomic_notifier_call_chain+0x16/0x20\\nirq_int_handler+0x19/0x30 [mlx5_core]\\n__handle_irq_event_percpu+0x4b/0x160\\nhandle_irq_event+0x2e/0x80\\nhandle_edge_irq+0x98/0x230\\n__common_interrupt+0x3b/0xa0\\ncommon_interrupt+0x7b/0xa0\\n\u003c/IRQ\u003e\\n\u003cTASK\u003e\\nasm_common_interrupt+0x22/0x40\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"5.10.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.11.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-23T15:48:40.659Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38555\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-23T15:48:40.659Z\", \"dateReserved\": \"2024-06-18T19:36:34.920Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:35:26.059Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2024-38555

Vulnerability from fkie_nvd - Published: 2024-06-19 14:15 - Updated: 2026-08-04 11:18

Severity

7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f6fbb8535e990f844371086ab2c1221f71f993d3",
              "status": "affected",
              "version": "27c79b3a9212cf4ba634c157e07d29548181a208",
              "versionType": "git"
            },
            {
              "lessThan": "3cb92b0ad73d3f1734e812054e698d655e9581b0",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "bf8aaf0ae01c27ae3c06aa8610caf91e50393396",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "1d5dce5e92a70274de67a59e1e674c3267f94cd7",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "7ac4c69c34240c6de820492c0a28a0bd1494265a",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "lessThan": "db9b31aa9bc56ff0d15b78f7e827d61c4a096e40",
              "status": "affected",
              "version": "51d138c2610a236c1ed0059d034ee4c74f452b86",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2e5d24b3bf091802c5456dc8f8f6a6be4493c8ca",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.219",
              "status": "affected",
              "version": "5.10.20",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/cmd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "12848580-6A3F-4069-9B0A-78AAA5E79BE7",
              "versionEndExcluding": "5.10.219",
              "versionStartIncluding": "5.10.20",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5A5A54E-7208-43CC-811F-57A4B7A4488D",
              "versionEndExcluding": "5.15.161",
              "versionStartIncluding": "5.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEFB78EE-F990-4197-BF1C-156760A55667",
              "versionEndExcluding": "6.1.93",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FCE796DF-3B50-4DC6-BAE5-95271068FC9E",
              "versionEndExcluding": "6.6.33",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "80550309-67AB-4FD1-AC07-3DED5C4F01B2",
              "versionEndExcluding": "6.8.12",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E07124C1-19E8-4D21-828D-9932A01D3011",
              "versionEndExcluding": "6.9.3",
              "versionStartIncluding": "6.9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Discard command completions in internal error\n\nFix use after free when FW completion arrives while device is in\ninternal error state. Avoid calling completion handler in this case,\nsince the device will flush the command interface and trigger all\ncompletions manually.\n\nKernel log:\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\n...\nRIP: 0010:refcount_warn_saturate+0xd8/0xe0\n...\nCall Trace:\n\u003cIRQ\u003e\n? __warn+0x79/0x120\n? refcount_warn_saturate+0xd8/0xe0\n? report_bug+0x17c/0x190\n? handle_bug+0x3c/0x60\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? refcount_warn_saturate+0xd8/0xe0\ncmd_ent_put+0x13b/0x160 [mlx5_core]\nmlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core]\ncmd_comp_notifier+0x1f/0x30 [mlx5_core]\nnotifier_call_chain+0x35/0xb0\natomic_notifier_call_chain+0x16/0x20\nmlx5_eq_async_int+0xf6/0x290 [mlx5_core]\nnotifier_call_chain+0x35/0xb0\natomic_notifier_call_chain+0x16/0x20\nirq_int_handler+0x19/0x30 [mlx5_core]\n__handle_irq_event_percpu+0x4b/0x160\nhandle_irq_event+0x2e/0x80\nhandle_edge_irq+0x98/0x230\n__common_interrupt+0x3b/0xa0\ncommon_interrupt+0x7b/0xa0\n\u003c/IRQ\u003e\n\u003cTASK\u003e\nasm_common_interrupt+0x22/0x40"
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: descartar la finalizaci\u00f3n de comandos en caso de error interno. Se corrige el use-after-free cuando llega la finalizaci\u00f3n del FW mientras el dispositivo est\u00e1 en estado de error interno. Evite llamar al controlador de finalizaci\u00f3n en este caso, ya que el dispositivo limpiar\u00e1 la interfaz de comando y activar\u00e1 todas las finalizaciones manualmente. Registro del kernel: ------------[ cortar aqu\u00ed ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Seguimiento de llamadas: ? __advertir+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0? report_bug+0x17c/0x190? handle_bug+0x3c/0x60? exc_invalid_op+0x14/0x70? asm_exc_invalid_op+0x16/0x20? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 cadena+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35 /0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0 xa0 interrupci\u00f3n_com\u00fan+0x7b/0xa0   asm_interrupci\u00f3n_com\u00fan+0x22 /0x40"
    }
  ],
  "id": "CVE-2024-38555",
  "lastModified": "2026-08-04T11:18:43.583",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38555",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-10T17:14:41.121534Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-06-19T14:15:15.720",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-3Q8R-MH7F-V4R2

Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2024-08-27 21:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Discard command completions in internal error

Fix use after free when FW completion arrives while device is in internal error state. Avoid calling completion handler in this case, since the device will flush the command interface and trigger all completions manually.

Kernel log: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. ... RIP: 0010:refcount_warn_saturate+0xd8/0xe0 ... Call Trace: ? __warn+0x79/0x120 ? refcount_warn_saturate+0xd8/0xe0 ? report_bug+0x17c/0x190 ? handle_bug+0x3c/0x60 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? refcount_warn_saturate+0xd8/0xe0 cmd_ent_put+0x13b/0x160 [mlx5_core] mlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core] cmd_comp_notifier+0x1f/0x30 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 mlx5_eq_async_int+0xf6/0x290 [mlx5_core] notifier_call_chain+0x35/0xb0 atomic_notifier_call_chain+0x16/0x20 irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x4b/0x160 handle_irq_event+0x2e/0x80 handle_edge_irq+0x98/0x230 __common_interrupt+0x3b/0xa0 common_interrupt+0x7b/0xa0 asm_common_interrupt+0x22/0x40

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-38555"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-19T14:15:15Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Discard command completions in internal error\n\nFix use after free when FW completion arrives while device is in\ninternal error state. Avoid calling completion handler in this case,\nsince the device will flush the command interface and trigger all\ncompletions manually.\n\nKernel log:\n------------[ cut here ]------------\nrefcount_t: underflow; use-after-free.\n...\nRIP: 0010:refcount_warn_saturate+0xd8/0xe0\n...\nCall Trace:\n\u003cIRQ\u003e\n? __warn+0x79/0x120\n? refcount_warn_saturate+0xd8/0xe0\n? report_bug+0x17c/0x190\n? handle_bug+0x3c/0x60\n? exc_invalid_op+0x14/0x70\n? asm_exc_invalid_op+0x16/0x20\n? refcount_warn_saturate+0xd8/0xe0\ncmd_ent_put+0x13b/0x160 [mlx5_core]\nmlx5_cmd_comp_handler+0x5f9/0x670 [mlx5_core]\ncmd_comp_notifier+0x1f/0x30 [mlx5_core]\nnotifier_call_chain+0x35/0xb0\natomic_notifier_call_chain+0x16/0x20\nmlx5_eq_async_int+0xf6/0x290 [mlx5_core]\nnotifier_call_chain+0x35/0xb0\natomic_notifier_call_chain+0x16/0x20\nirq_int_handler+0x19/0x30 [mlx5_core]\n__handle_irq_event_percpu+0x4b/0x160\nhandle_irq_event+0x2e/0x80\nhandle_edge_irq+0x98/0x230\n__common_interrupt+0x3b/0xa0\ncommon_interrupt+0x7b/0xa0\n\u003c/IRQ\u003e\n\u003cTASK\u003e\nasm_common_interrupt+0x22/0x40",
  "id": "GHSA-3q8r-mh7f-v4r2",
  "modified": "2024-08-27T21:31:13Z",
  "published": "2024-06-19T15:30:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38555"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1337ec94bc5a9eed250e33f5f5c89a28a6bfabdb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1d5dce5e92a70274de67a59e1e674c3267f94cd7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3cb92b0ad73d3f1734e812054e698d655e9581b0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7ac4c69c34240c6de820492c0a28a0bd1494265a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bf8aaf0ae01c27ae3c06aa8610caf91e50393396"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/db9b31aa9bc56ff0d15b78f7e827d61c4a096e40"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f6fbb8535e990f844371086ab2c1221f71f993d3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

ICSA-25-226-15

Vulnerability from csaf_cisa - Published: 2025-08-12 00:00 - Updated: 2026-02-25 07:00

Summary

Siemens SINEC OS

Scope

381 vulnerabilities in this advisory, including CVE-2024-38555.

CVE-2024-38555

0.0 (None)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:N

Known affected: 2 products Known not affected: 1 product

https://support.industry.siemens.com/cs/ww/en/view/109977557/

Open the full advisory

RHSA-2024:10771

Vulnerability from csaf_redhat - Published: 2024-12-04 00:56 - Updated: 2026-09-13 08:43

Summary

Red Hat Security Advisory: kernel security update

Severity

Moderate

Scope

36 vulnerabilities in this advisory, including CVE-2024-38555.

CVE-2024-38555

A use-after-free vulnerability has been discovered in the Linux kernel within the drivers/net/ethernet/mellanox/mlx5/core/cmd.c component, specifically related to the Mellanox network driver. This flaw can lead to compromised system availability. Successful exploitation could result in unpredictable behavior and denial-of-service conditions.

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fixed: 279 products

https://access.redhat.com/errata/RHSA-2024:10771

Open the full advisory

RHSA-2024:5065

Vulnerability from csaf_redhat - Published: 2024-08-07 00:28 - Updated: 2026-08-04 18:57

Summary

Red Hat Security Advisory: kernel security update

Severity

Moderate

Scope

12 vulnerabilities in this advisory, including CVE-2024-38555.

CVE-2024-38555

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fixed: 146 products

https://access.redhat.com/errata/RHSA-2024:5065

Open the full advisory

RHSA-2024:5101

Vulnerability from csaf_redhat - Published: 2024-08-08 04:53 - Updated: 2026-09-13 08:28

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Scope

170 vulnerabilities in this advisory, including CVE-2024-38555.

CVE-2024-38555

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fixed: 120 products

https://access.redhat.com/errata/RHSA-2024:5101

Open the full advisory

RHSA-2024:5102

Vulnerability from csaf_redhat - Published: 2024-08-08 04:44 - Updated: 2026-09-13 08:28

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Scope

149 vulnerabilities in this advisory, including CVE-2024-38555.

CVE-2024-38555

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fixed: 30 products

https://access.redhat.com/errata/RHSA-2024:5102

Open the full advisory

RHSA-2024:5255

Vulnerability from csaf_redhat - Published: 2024-08-13 10:53 - Updated: 2026-09-01 11:55

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Scope

22 vulnerabilities in this advisory, including CVE-2024-38555.

CVE-2024-38555

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fixed: 120 products Known not affected: 8 products

https://access.redhat.com/errata/RHSA-2024:5255

Open the full advisory

RHSA-2024:5364

Vulnerability from csaf_redhat - Published: 2024-08-14 01:27 - Updated: 2026-09-01 11:55

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2024-38555.

CVE-2024-38555

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fixed: 201 products

https://access.redhat.com/errata/RHSA-2024:5364

Open the full advisory

RHSA-2024:5365

Vulnerability from csaf_redhat - Published: 2024-08-14 01:27 - Updated: 2026-09-01 11:55

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Scope

23 vulnerabilities in this advisory, including CVE-2024-38555.

CVE-2024-38555

4.4 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Fixed: 34 products

https://access.redhat.com/errata/RHSA-2024:5365

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-38555 (GCVE-0-2024-38555)

Tags

Sightings

Nomenclature

Related by attack behaviour