CVE-2021-47261: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-47261 affects the Linux kernel's InfiniBand (IB) MLX5 driver. The vulnerability was discovered in the initialization of CQ fragments buffer functionality, specifically in the init_cq_frag_buf() function. The issue was publicly disclosed on May 21, 2024, and affects the Linux kernel's mlx5 InfiniBand driver (NVD).

The vulnerability exists in the init_cq_frag_buf() function which can be called to initialize either the current CQ fragments buffer (cq->buf) or the temporary resize buffer (cq->resize_buf) during CQ resize operations. The issue arose when the function get_cqe() was used to retrieve CQEs, as it always returns CQEs from cq->buf. This leads to initialization of the wrong buffer, and when enlarging the CQ, it attempts to access elements beyond the size of the current cq->buf, resulting in a kernel panic (Kernel Commit).

When exploited, this vulnerability can cause a kernel panic, particularly during CQ resize operations. This can lead to system instability and potential denial of service conditions (NVD).

The vulnerability can be triggered during CQ resize operations in the MLX5 InfiniBand driver. A specific call trace has been identified: mlx5_ib_resize_cq -> ib_resize_cq -> llt_rdma_setup_qp -> llt_rdma_cc_event_action -> llt_rdma_client_conn_thread -> kthread (Kernel Commit).

The issue has been fixed by modifying the init_cq_frag_buf() function to use mlx5_frag_buf_get_wqe() instead of get_cqe(). This new function takes the correct source buffer as a parameter, ensuring proper buffer initialization. The fix has been implemented in the Linux kernel (Kernel Commit).