CVE-2024-38556

HighCVSS 7.8/10Last modified Aug 4, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Add a timeout to acquire the command queue semaphore

Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion.

Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

VendorProductVersions
LinuxLinux>= 8e715cd613a1e872b9d918e912d90b399785761a, < 4baae687a20ef2b82fde12de3c04461e6f2521d6; >= 8e715cd613a1e872b9d918e912d90b399785761a, < f9caccdd42e999b74303c9b0643300073ed5d319; >= 8e715cd613a1e872b9d918e912d90b399785761a, < 2d0962d05c93de391ce85f6e764df895f47c8918; >= 8e715cd613a1e872b9d918e912d90b399785761a, < 94024332a129c6e4275569d85c0c1bfb2ae2d71b; >= 8e715cd613a1e872b9d918e912d90b399785761a, < 485d65e1357123a697c591a5aeb773994b247ad7; 74dd45122b84479eee50bd0956ae8bc5799c9f8a; e801f81cee3c8901f52ee48c6329802b28fbb49c; d73d81447c6651904dd4a9e3fd88651ff174c1b7; 4646175c19fd019b773444a11ff62748eb83745b; >= 5.4.174, < 5.5; >= 5.10.94, < 5.11; >= 5.15.17, < 5.16; >= 5.16.3, < 5.17
LinuxLinux5.17

References

Timeline

Published
Jun 19, 2024
Last modified
Aug 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-385575.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Reload only IB representors upon lag disable/enable On lag dCVE-2024-385585.5In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple for ICMPv6 OVS_PACCVE-2024-385594.4In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Ensure the copied buf is NUL terminated Currently, we alloCVE-2024-38568.8A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulnerability affects FirCVE-2024-385607.1In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Ensure the copied buf is NUL terminated Currently, we allocCVE-2024-385617.0In the Linux kernel, the following vulnerability has been resolved: kunit: Fix kthread reference There is a race condition when a kthread CVE-2024-385627.8In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: Avoid address calculations via out of bounds array indexCVE-2024-385635.5In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix potential memory leakage when reading chip tempCVE-2024-385645.5In the Linux kernel, the following vulnerability has been resolved: bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CCVE-2024-385655.5In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: enable proper endpoint verification Syzkaller reports [1CVE-2024-385665.5In the Linux kernel, the following vulnerability has been resolved: bpf: Fix verifier assumptions about socket->sk The verifier assumes thCVE-2024-385675.5In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: add a proper sanity check for endpoints Syzkaller repo
CVE-2024-38556: High severity, CVSS 7.8 | Vulnix