{"id":"DEBIAN-CVE-2024-50147","details":"In the Linux kernel, the following vulnerability has been resolved:  net/mlx5: Fix command bitmask initialization  Command bitmask have a dedicated bit for MANAGE_PAGES command, this bit isn't Initialize during command bitmask Initialization, only during MANAGE_PAGES.  In addition, mlx5_cmd_trigger_completions() is trying to trigger completion for MANAGE_PAGES command as well.  Hence, in case health error occurred before any MANAGE_PAGES command have been invoke (for example, during mlx5_enable_hca()), mlx5_cmd_trigger_completions() will try to trigger completion for MANAGE_PAGES command, which will result in null-ptr-deref error.[1]  Fix it by Initialize command bitmask correctly.  While at it, re-write the code for better understanding.  [1] BUG: KASAN: null-ptr-deref in mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core] Write of size 4 at addr 0000000000000214 by task kworker/u96:2/12078 CPU: 10 PID: 12078 Comm: kworker/u96:2 Not tainted 6.9.0-rc2_for_upstream_debug_2024_04_07_19_01 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Workqueue: mlx5_health0000:08:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] Call Trace:  \u003cTASK\u003e  dump_stack_lvl+0x7e/0xc0  kasan_report+0xb9/0xf0  kasan_check_range+0xec/0x190  mlx5_cmd_trigger_completions+0x1db/0x600 [mlx5_core]  mlx5_cmd_flush+0x94/0x240 [mlx5_core]  enter_error_state+0x6c/0xd0 [mlx5_core]  mlx5_fw_fatal_reporter_err_work+0xf3/0x480 [mlx5_core]  process_one_work+0x787/0x1490  ? lockdep_hardirqs_on_prepare+0x400/0x400  ? pwq_dec_nr_in_flight+0xda0/0xda0  ? assign_work+0x168/0x240  worker_thread+0x586/0xd30  ? rescuer_thread+0xae0/0xae0  kthread+0x2df/0x3b0  ? kthread_complete_and_exit+0x20/0x20  ret_from_fork+0x2d/0x70  ? kthread_complete_and_exit+0x20/0x20  ret_from_fork_asm+0x11/0x20  \u003c/TASK\u003e","modified":"2026-09-15T09:02:59.020853304Z","published":"2024-11-07T10:15:06.507Z","upstream":["CVE-2024-50147"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-50147"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.115-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50147.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50147.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.11.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-50147.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}