Executive brief
A race condition vulnerability was identified in the Linux kernel's RDMA (Remote Direct Memory Access) over Ethernet driver. This flaw occurs when the system is attempting to shut down or clean up specific networking tasks, potentially allowing a task to continue running after its memory has been freed. An attacker with local access could exploit this to cause a system crash or potentially execute unauthorized code, impacting system stability and data integrity.
Technical details
A race condition exists in the RDMA/rxe implementation within the Linux kernel, specifically in the do_task() function in drivers/infiniband/sw/rxe/rxe_task.c. When do_task() exhausts its iteration budget, it sets the task state to TASK_STATE_IDLE without checking if a concurrent thread has set the state to TASK_STATE_DRAINING via rxe_cleanup_task() or rxe_disable_task(). Because the cleanup functions release their spinlocks while waiting for the task to finish, do_task() can acquire the lock and overwrite the draining state. This leads to a use-after-free scenario where the cleanup logic proceeds to free resources while the task incorrectly reschedules itself. The issue was introduced during the migration from tasklets to workqueues and has been fixed by ensuring the state is not overwritten if it is already in a draining state.
Affected products
- Linux Linux Kernel 6.5 to 6.6.112, 6.12.53, 6.17.3
Timeline
- 2025-09-19: other: Patch submitted by Gui-Dong Han
- 2025-10-28: disclosed: CVE published