Executive brief
The Linux kernel's RDMA/rxe driver (a software-based Remote Direct Memory Access implementation) has a vulnerability where uninitialized function pointers can be dereferenced during cleanup of failed queue pair initialization. An attacker or system administrator with the ability to trigger queue pair creation failures could cause the kernel to crash, leading to a denial of service of systems using this driver.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the RDMA/rxe driver's queue pair destruction logic. When rxe_queue_init fails during rxe_qp_init_req, the qp->req.task.func and qp->req.task.arg fields remain uninitialized. The subsequent cleanup path (rxe_qp_do_cleanup or rxe_qp_destroy) calls __rxe_do_task without checking if qp->req.task.func is initialized, leading to a NULL pointer dereference. The fix adds a guard check to verify qp->req.task.func is non-NULL before invoking __rxe_do_task. This is a local kernel logic error requiring system-level access to trigger queue pair creation, applicable to systems using the software RoCE driver.
Affected products
- Linux Linux kernel Multiple stable versions affected; patched in linux-5.19, linux-6.1, and later stable series
Timeline
- 2022-08-21: disclosed
- 2022-10-21: patched
- 2025-12-09: advisory