Executive brief
The Linux kernel contains a data race in the RDMA/irdma driver's queue pair completion handler. This race condition could allow an attacker with local access to cause a denial of service or potentially corrupt kernel memory. The vulnerability affects systems using Intel RDMA drivers for high-speed network communication.
Technical details
The vulnerability is a data race (CWE-366) in the RDMA/irdma driver where the cqp_request->request_done field is accessed locklessly in irdma_handle_cqp_op while being concurrently updated in irdma_cqp_ce_handler. KCSAN (Kernel Concurrency Sanitizer) detects unsynchronized reads and writes to shared memory at 0xffff8e44107019dc. The race occurs during device shutdown when CQP (Completion Queue Pair) operations are being torn down. An attacker with local code execution or a malicious kernel module could trigger this race during driver unload, potentially leading to use-after-free, memory corruption, or kernel panic. The fix involves annotating the lockless access with READ_ONCE/WRITE_ONCE compiler intrinsics to prevent harmful compiler optimizations.
Affected products
- Linux Linux kernel affected versions prior to fix implementation
Timeline
- 2025-12-30: disclosed: CVE-2023-54292 published