Junglewise Threat Intelligence

CVE-2026-31425: Linux Kernel NULL pointer dereference in RDS Infiniband implementation

CVE-2026-31425 · Severity: medium · CVSS 5.5 · Published 2026-04-13

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Reliable Datagram Sockets (RDS) protocol could allow a local user to crash the system. The issue occurs when the system attempts to register memory for high-speed data transfers before a network connection is fully established. This results in a kernel crash (denial of service), potentially disrupting operations and requiring a system reboot.

Technical details

A NULL pointer dereference exists in the RDS (Reliable Datagram Sockets) Infiniband (IB) implementation within the Linux kernel. The vulnerability occurs in rds_ib_get_mr() when processing a sendmsg() call with the RDS_CMSG_RDMA_MAP control message on a fresh outgoing connection. Because the connection worker may not have yet initialized the rdma_cm_id, the function rds_ib_post_reg_frmr() attempts to dereference ic->i_cm_id->qp while it is still NULL. This flaw allows a local attacker with the ability to send RDS messages to trigger a kernel panic. Patches have been released across multiple stable kernel branches to add proper validation checks for the connection state before proceeding with memory registration.

Affected products

  • Linux Linux Kernel 4.6 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12

Timeline

  • 2026-04-13: advisory: CVE-2026-31425 published by kernel.org
  • 2026-04-11: patched: Fix committed to stable kernel trees

References

Related threats