CVE-2024-38556: Linux Kernel

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Add a timeout to acquire the command queue semaphore Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion. Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion

Affected products

• Linux Linux Kernel: from 5.4.174, before 5.5 (fixed in 5.5); from 5.10.94, before 5.11 (fixed in 5.11); from 5.15.17, before 5.16 (fixed in 5.16); from 5.16.3, up to and including 6.1.93; from 6.2, up to and including 6.6.33; from 6.7, up to and including 6.8.12; …

Published 2024-06-19. Last modified 2026-08-04.