Executive brief
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) component could allow a local user to crash the system. The issue occurs when specific network queue operations fail, leaving the system in an unstable state that leads to a crash upon subsequent requests. This primarily impacts system availability and could potentially be used to disrupt operations or facilitate further attacks.
Technical details
A NULL pointer dereference exists in the RDMA/rxe driver within the rxe_srq_chk_attr() function. The vulnerability is triggered when ibv_modify_srq() is called twice in succession. If the first call fails during rxe_queue_resize(), the error handling in rxe_srq_from_attr() incorrectly sets srq->rq.queue to NULL without proper state recovery. A subsequent call then attempts to access srq->rq.queue->buf->index_mask, resulting in a kernel panic. This is a local attack vector requiring basic user privileges to interact with RDMA verbs. Patches have been released for various stable kernel branches including 6.6.y, 6.12.y, and 6.18.y.
Affected products
- Linux Linux Kernel 4.8 to 6.6.120, 6.12.63, 6.17.13, 6.18.2
Timeline
- 2025-10-27: disclosed: Initial patch submission
- 2025-12-24: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/503a5e4690ae14c18570141bc0dcf7501a8419b0
- https://git.kernel.org/stable/c/58aca869babd48cb9c3d6ee9e1452c4b9f5266a6
- https://git.kernel.org/stable/c/5dbeb421e137824aa9bd8358bdfc926a3965fc0d
- https://git.kernel.org/stable/c/b8f6eeb87a76b6fb1f6381b0b2894568e1b784f7
- https://git.kernel.org/stable/c/bc4c14a3863cc0e03698caec9a0cdabd779776ee