Executive brief
The Linux kernel's InfiniBand isert (iSER Target) module contains a resource management flaw that can cause system instability during device removal or DEVICE_REMOVAL events. An attacker or admin with the ability to trigger device removal can exhaust kernel resources, resulting in system warnings, memory leaks, or potential denial of service on systems using InfiniBand over Ethernet.
Technical details
The vulnerability is a resource management bug in the InfiniBand isert connection handling code. Commit 699826f4e30a introduced a fix that inadvertently causes incorrect resource release during DEVICE_REMOVAL events on OPA (Omni-Path Architecture) devices, leading to kernel warnings in ib_cq_pool_cleanup. The flaw manifests when the kernel attempts to unregister InfiniBand devices, triggering a cascading cleanup that fails to properly release completion queue (CQ) resources, resulting in a BUG_ON condition. The vulnerability is triggered during device removal operations and affects systems with InfiniBand adapters. A fix is available via revert of the problematic commit.
Affected products
- Linux Linux kernel 6.5.0-rc1 and related versions containing commit 699826f4e30a
Timeline
- 2025-12-30: disclosed