GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-38556 (GCVE-0-2024-38556)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:35 – Updated: 2026-08-05 11:32
VLAI
Title
net/mlx5: Add a timeout to acquire the command queue semaphore
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Add a timeout to acquire the command queue semaphore Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion. Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-21 14:39 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8e715cd613a1e872b9d918e912d90b399785761a , < 4baae687a20ef2b82fde12de3c04461e6f2521d6 (git)
Affected: 8e715cd613a1e872b9d918e912d90b399785761a , < f9caccdd42e999b74303c9b0643300073ed5d319 (git)
Affected: 8e715cd613a1e872b9d918e912d90b399785761a , < 2d0962d05c93de391ce85f6e764df895f47c8918 (git)
Affected: 8e715cd613a1e872b9d918e912d90b399785761a , < 94024332a129c6e4275569d85c0c1bfb2ae2d71b (git)
Affected: 8e715cd613a1e872b9d918e912d90b399785761a , < 485d65e1357123a697c591a5aeb773994b247ad7 (git)
Affected: 74dd45122b84479eee50bd0956ae8bc5799c9f8a (git)
Affected: e801f81cee3c8901f52ee48c6329802b28fbb49c (git)
Affected: d73d81447c6651904dd4a9e3fd88651ff174c1b7 (git)
Affected: 4646175c19fd019b773444a11ff62748eb83745b (git)
Affected: 5.4.174 , < 5.5 (semver)
Affected: 5.10.94 , < 5.11 (semver)
Affected: 5.15.17 , < 5.16 (semver)
Affected: 5.16.3 , < 5.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38556",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-21T14:39:36.786296Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-21T14:40:06.541Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
            "include/linux/mlx5/driver.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4baae687a20ef2b82fde12de3c04461e6f2521d6",
              "status": "affected",
              "version": "8e715cd613a1e872b9d918e912d90b399785761a",
              "versionType": "git"
            },
            {
              "lessThan": "f9caccdd42e999b74303c9b0643300073ed5d319",
              "status": "affected",
              "version": "8e715cd613a1e872b9d918e912d90b399785761a",
              "versionType": "git"
            },
            {
              "lessThan": "2d0962d05c93de391ce85f6e764df895f47c8918",
              "status": "affected",
              "version": "8e715cd613a1e872b9d918e912d90b399785761a",
              "versionType": "git"
            },
            {
              "lessThan": "94024332a129c6e4275569d85c0c1bfb2ae2d71b",
              "status": "affected",
              "version": "8e715cd613a1e872b9d918e912d90b399785761a",
              "versionType": "git"
            },
            {
              "lessThan": "485d65e1357123a697c591a5aeb773994b247ad7",
              "status": "affected",
              "version": "8e715cd613a1e872b9d918e912d90b399785761a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "74dd45122b84479eee50bd0956ae8bc5799c9f8a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e801f81cee3c8901f52ee48c6329802b28fbb49c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d73d81447c6651904dd4a9e3fd88651ff174c1b7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4646175c19fd019b773444a11ff62748eb83745b",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.174",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.94",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.17",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
            "include/linux/mlx5/driver.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.174",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Add a timeout to acquire the command queue semaphore\n\nPrevent forced completion handling on an entry that has not yet been\nassigned an index, causing an out of bounds access on idx = -22.\nInstead of waiting indefinitely for the sem, blocking flow now waits for\nindex to be allocated or a sem acquisition timeout before beginning the\ntimer for FW completion.\n\nKernel log example:\nmlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The mlx5 firmware command interface is driven by local callers \u2014 RDMA uverbs/DEVX ioctls on /dev/infiniband/uverbs*, netdev/ethtool/devlink ops \u2014 not by received network packets. The reported trigger (CREATE_UCTX from a userspace pid) is a local ioctl path.\nAC:L - The attacker controls both sides: they flood the command interface to keep all max_reg_cmds slots occupied (a saturation mode mlx5 maintainers explicitly documented for unprivileged/high-rate command issuers) while issuing the victim blocking command that parks on the semaphore, and each resulting timeout permanently leaks a slot, making the exhausted-semaphore state self-reinforcing and eventually deterministic.\nPR:L - An unprivileged local user with access to /dev/infiniband/uverbs* (mode 0666 under stock rdma-core udev rules on RDMA-enabled hosts) can issue the exact CREATE_UCTX command from the report via ALLOC_UCONTEXT with MLX5_IB_ALLOC_UCTX_DEVX, with no capability check on that path.\nUI:N - Exploitation requires only the attacker\u0027s own syscalls/ioctls against the RDMA device; no action by any other user or administrator is needed.\nS:U - The use-after-free and its consequences are confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The freed mlx5_cmd_work_ent is reused by the still-parked work handler, which reads ent-\u003ein/ent-\u003eout/ent-\u003euout pointers out of reclaimed heap memory and copies FW output through them, giving an attacker who sprays the freed slot a read primitive into kernel memory.\nI:H - The parked handler writes ent-\u003eidx, ent-\u003elay and ent-\u003ets1 into freed memory, installs a dangling pointer in cmd-\u003eent_arr[] that a later FW completion dereferences to call ent-\u003ecallback(err, context) \u2014 a function pointer taken from sprayable freed memory \u2014 and programs DMA addresses read from freed memory into the NIC command descriptor before ringing the doorbell.\nA:H - The bug produces stuck commands, permanently leaked command-queue slots that eventually wedge the entire firmware command interface (rendering the NIC unconfigurable), plus a use-after-free that reliably causes oops/panic even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:32:46.140Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918"
        },
        {
          "url": "https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b"
        },
        {
          "url": "https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7"
        }
      ],
      "title": "net/mlx5: Add a timeout to acquire the command queue semaphore",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38556",
    "datePublished": "2024-06-19T13:35:26.753Z",
    "dateReserved": "2024-06-18T19:36:34.921Z",
    "dateUpdated": "2026-08-05T11:32:46.140Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38556",
      "date": "2026-09-19",
      "epss": "0.00259",
      "percentile": "0.17924"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Add a timeout to acquire the command queue semaphore\n\nPrevent forced completion handling on an entry that has not yet been\nassigned an index, causing an out of bounds access on idx = -22.\nInstead of waiting indefinitely for the sem, blocking flow now waits for\nindex to be allocated or a sem acquisition timeout before beginning the\ntimer for FW completion.\n\nKernel log example:\nmlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion"
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: agrega un tiempo de espera para adquirir el sem\u00e1foro de la cola de comandos. Evita el manejo de finalizaci\u00f3n forzada en una entrada a la que a\u00fan no se le ha asignado un \u00edndice, lo que provoca un acceso fuera de los l\u00edmites en idx = -22. En lugar de esperar indefinidamente el sem, el flujo de bloqueo ahora espera a que se asigne el \u00edndice o a que se agote el tiempo de espera de adquisici\u00f3n del sem antes de iniciar el temporizador para completar el FW. Ejemplo de registro del kernel: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No se complet\u00f3"
        }
      ],
      "id": "CVE-2024-38556",
      "lastModified": "2024-11-21T09:26:20.280",
      "published": "2024-06-19T14:15:15.810",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T14:54:22.000Z",
      "cve": "CVE-2024-38556",
      "id": "msrc_CVE-2024-38556",
      "initial_release_date": "2024-06-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/mlx5: Add a timeout to acquire the command queue semaphore",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-38556.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
                  "include/linux/mlx5/driver.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4baae687a20ef2b82fde12de3c04461e6f2521d6",
                    "status": "affected",
                    "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f9caccdd42e999b74303c9b0643300073ed5d319",
                    "status": "affected",
                    "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2d0962d05c93de391ce85f6e764df895f47c8918",
                    "status": "affected",
                    "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "94024332a129c6e4275569d85c0c1bfb2ae2d71b",
                    "status": "affected",
                    "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "485d65e1357123a697c591a5aeb773994b247ad7",
                    "status": "affected",
                    "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "74dd45122b84479eee50bd0956ae8bc5799c9f8a",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "e801f81cee3c8901f52ee48c6329802b28fbb49c",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "d73d81447c6651904dd4a9e3fd88651ff174c1b7",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "4646175c19fd019b773444a11ff62748eb83745b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "affected",
                    "version": "5.4.174",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.11",
                    "status": "affected",
                    "version": "5.10.94",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "affected",
                    "version": "5.15.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "affected",
                    "version": "5.16.3",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
                  "include/linux/mlx5/driver.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.17"
                  },
                  {
                    "lessThan": "5.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.8.*",
                    "status": "unaffected",
                    "version": "6.8.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.9.*",
                    "status": "unaffected",
                    "version": "6.9.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.10",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B9BC8CC5-AB06-4C51-869B-2FE0820D0AC1",
                    "versionEndExcluding": "5.5",
                    "versionStartIncluding": "5.4.174",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D97173A0-CD12-4773-B2F5-A9037AAB0383",
                    "versionEndExcluding": "5.11",
                    "versionStartIncluding": "5.10.94",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE141E86-782B-4D36-B214-2FB7AC66A083",
                    "versionEndExcluding": "5.16",
                    "versionStartIncluding": "5.15.17",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EB815E0A-660A-44C3-9033-8B7238B7CA4F",
                    "versionEndIncluding": "6.1.93",
                    "versionStartIncluding": "5.16.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3254742F-9901-4088-ACB5-27405BB2343E",
                    "versionEndIncluding": "6.6.33",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F5EDD0D5-6B6E-4F6A-A099-30679CC81755",
                    "versionEndIncluding": "6.8.12",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9A21A3C2-C96F-4722-B347-C34D308A1B12",
                    "versionEndIncluding": "6.9.3",
                    "versionStartIncluding": "6.9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Add a timeout to acquire the command queue semaphore\n\nPrevent forced completion handling on an entry that has not yet been\nassigned an index, causing an out of bounds access on idx = -22.\nInstead of waiting indefinitely for the sem, blocking flow now waits for\nindex to be allocated or a sem acquisition timeout before beginning the\ntimer for FW completion.\n\nKernel log example:\nmlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion"
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/mlx5: agrega un tiempo de espera para adquirir el sem\u00e1foro de la cola de comandos. Evita el manejo de finalizaci\u00f3n forzada en una entrada a la que a\u00fan no se le ha asignado un \u00edndice, lo que provoca un acceso fuera de los l\u00edmites en idx = -22. En lugar de esperar indefinidamente el sem, el flujo de bloqueo ahora espera a que se asigne el \u00edndice o a que se agote el tiempo de espera de adquisici\u00f3n del sem antes de iniciar el temporizador para completar el FW. Ejemplo de registro del kernel: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No se complet\u00f3"
          }
        ],
        "id": "CVE-2024-38556",
        "lastModified": "2026-08-04T11:18:43.907",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-38556",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-21T14:39:36.786296Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-06-19T14:15:15.810",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-129"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:46:51+00:00",
      "cve": "CVE-2024-38556",
      "id": "CVE-2024-38556",
      "initial_release_date": "2024-06-19T00:00:00+00:00",
      "product_status:fixed": "514",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5: Add a timeout to acquire the command queue semaphore",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38556.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T02:29:44Z",
      "cve": "CVE-2024-38556",
      "id": "CVE-2024-38556",
      "initial_release_date": "2024-06-22T03:35:29Z",
      "product_status:known_affected": "468",
      "product_status:known_not_affected": "176",
      "product_status:recommended": "680",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-38556",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-38556.json",
      "version": "86"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T04:12:25.318Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-38556",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-21T14:39:36.786296Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-21T14:39:59.910Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
                "include/linux/mlx5/driver.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "4baae687a20ef2b82fde12de3c04461e6f2521d6",
                  "status": "affected",
                  "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                  "versionType": "git"
                },
                {
                  "lessThan": "f9caccdd42e999b74303c9b0643300073ed5d319",
                  "status": "affected",
                  "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                  "versionType": "git"
                },
                {
                  "lessThan": "2d0962d05c93de391ce85f6e764df895f47c8918",
                  "status": "affected",
                  "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                  "versionType": "git"
                },
                {
                  "lessThan": "94024332a129c6e4275569d85c0c1bfb2ae2d71b",
                  "status": "affected",
                  "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                  "versionType": "git"
                },
                {
                  "lessThan": "485d65e1357123a697c591a5aeb773994b247ad7",
                  "status": "affected",
                  "version": "8e715cd613a1e872b9d918e912d90b399785761a",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "74dd45122b84479eee50bd0956ae8bc5799c9f8a",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "e801f81cee3c8901f52ee48c6329802b28fbb49c",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "d73d81447c6651904dd4a9e3fd88651ff174c1b7",
                  "versionType": "git"
                },
                {
                  "status": "affected",
                  "version": "4646175c19fd019b773444a11ff62748eb83745b",
                  "versionType": "git"
                },
                {
                  "lessThan": "5.5",
                  "status": "affected",
                  "version": "5.4.174",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.11",
                  "status": "affected",
                  "version": "5.10.94",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.16",
                  "status": "affected",
                  "version": "5.15.17",
                  "versionType": "semver"
                },
                {
                  "lessThan": "5.17",
                  "status": "affected",
                  "version": "5.16.3",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/net/ethernet/mellanox/mlx5/core/cmd.c",
                "include/linux/mlx5/driver.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.17"
                },
                {
                  "lessThan": "5.17",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.93",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.33",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.8.*",
                  "status": "unaffected",
                  "version": "6.8.12",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.9.*",
                  "status": "unaffected",
                  "version": "6.9.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.10",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.93",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.33",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.8.12",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.9.3",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.10",
                      "versionStartIncluding": "5.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.4.174",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.10.94",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.15.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionStartIncluding": "5.16.3",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Add a timeout to acquire the command queue semaphore\n\nPrevent forced completion handling on an entry that has not yet been\nassigned an index, causing an out of bounds access on idx = -22.\nInstead of waiting indefinitely for the sem, blocking flow now waits for\nindex to be allocated or a sem acquisition timeout before beginning the\ntimer for FW completion.\n\nKernel log example:\nmlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion"
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-23T15:48:49.481Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/4baae687a20ef2b82fde12de3c04461e6f2521d6"
            },
            {
              "url": "https://git.kernel.org/stable/c/f9caccdd42e999b74303c9b0643300073ed5d319"
            },
            {
              "url": "https://git.kernel.org/stable/c/2d0962d05c93de391ce85f6e764df895f47c8918"
            },
            {
              "url": "https://git.kernel.org/stable/c/94024332a129c6e4275569d85c0c1bfb2ae2d71b"
            },
            {
              "url": "https://git.kernel.org/stable/c/485d65e1357123a697c591a5aeb773994b247ad7"
            }
          ],
          "title": "net/mlx5: Add a timeout to acquire the command queue semaphore",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-38556",
        "datePublished": "2024-06-19T13:35:26.753Z",
        "dateReserved": "2024-06-18T19:36:34.921Z",
        "dateUpdated": "2026-05-23T15:48:49.481Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.