CVE-2026-45973: RDMA/mlx5: Fix UMR hang in LAG error state unload
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix UMR hang in LAG error state unload
During firmware reset in LAG mode, a race condition causes the driver to hang indefinitely while waiting for UMR completion during device unload. See [1].
In LAG mode the bond device is only registered on the master, so it never sees syserror events from the slave. During firmware reset this causes UMR waits to hang forever on unload as the slave is dead but the master hasn't entered error state yet, so UMR posts succeed but completions never arrive.
Fix this by adding a syserror notifier that gets registered before MLX5IBSTAGEIBREG and stays alive until after ibunregisterdevice(). This ensures error events reach the bond device throughout teardown.
[1] Call Trace: schedule+0x2bd/0x760 schedule+0x37/0xa0 schedulepreemptdisabled+0xa/0x10 mutexlock.isra.6+0x2b5/0x4a0 mlx5ibderegmr+0x606/0x870 [mlx5ib] ? xaerase+0x4a/0xa0 ? condresched+0x15/0x30 ? waitforcompletion+0x31/0x100 ibderegmruser+0x48/0xc0 [ibcore] ? rdmacgunchargehierarchy+0xa0/0x100 destroyhwidruobject+0x20/0x50 [ibuverbs] uverbsdestroyuobject+0x37/0x150 [ibuverbs] uverbscleanupufile+0xda/0x140 [ibuverbs] uverbsdestroyufilehw+0x3a/0xf0 [ibuverbs] ibuverbsremoveone+0xc3/0x140 [ibuverbs] removeclientcontext+0x8b/0xd0 [ibcore] disabledevice+0x8c/0x130 [ibcore] ibunregisterdevice+0x10d/0x180 [ibcore] ibunregisterdevice+0x21/0x30 [ibcore] mlx5ibremove+0x1e4/0x1f0 [mlx5ib] auxiliarybusremove+0x1e/0x30 devicereleasedriverinternal+0x103/0x1f0 busremovedevice+0xf7/0x170 devicedel+0x181/0x410 mlx5rescandriverslocked.part.10+0xa9/0x1d0 [mlx5core] mlx5disablelag+0x253/0x260 [mlx5core] mlx5lagdisablechange+0x89/0xc0 [mlx5core] mlx5eswitchdisable+0x67/0xa0 [mlx5core] mlx5unload+0x15/0xd0 [mlx5core] mlx5unloadone+0x71/0xc0 [mlx5core] mlx5syncresetreloadwork+0x83/0x100 [mlx5core] processonework+0x1a7/0x360 workerthread+0x30/0x390 ? createworker+0x1a0/0x1a0 kthread+0x116/0x130 ? kthreadflushworkfn+0x10/0x10 retfromfork+0x22/0x40
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45973?
The severity of CVE-2026-45973 is medium with a score of 5.5 according to the CVSS 3.1 metrics.
What type of vulnerability is CVE-2026-45973?
CVE-2026-45973 is categorized as a race condition vulnerability in the Linux kernel.
How does CVE-2026-45973 affect the system?
CVE-2026-45973 can cause the RDMA/mlx5 driver to hang indefinitely during device unload in certain conditions.
How do I fix CVE-2026-45973?
To fix CVE-2026-45973, it is recommended to update the Linux kernel to the latest version that includes the fix for this vulnerability.
What software is impacted by CVE-2026-45973?
CVE-2026-45973 affects the Linux kernel, specifically the mlx5 RDMA driver.