Executive brief
A vulnerability in the Linux kernel's RDMA driver can cause a system deadlock when a network device is reset while high-performance data applications are active. This could allow a local user to cause a denial-of-service condition, effectively freezing the system or specific networking functions. The issue primarily affects systems using Intel RDMA (irdma) hardware and certain industrial controllers from Siemens that utilize this kernel code.
Technical details
A deadlock exists in the RDMA/irdma driver within the Linux kernel due to a circular dependency during device removal. When a netdev reset is triggered, the 'ice' driver removes the 'irdma' auxiliary driver, initiating a device deletion sequence. In iWARP mode, the 'uverbs_client' waits for the Queue Pair (QP) reference count to reach zero; however, the 'cma_client' may hold the final reference, resulting in an indefinite wait. This improper locking (CWE-667) is resolved by skipping the QP reference count wait specifically during a device reset. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel versions prior to 6.8.1 (stable) and other backported branches
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-03-16: other: Patch authored by Intel engineers
- 2026-04-24: disclosed: CVE published
- 2026-07-14: advisory: Siemens advisory updated with affected product details
References
- https://git.kernel.org/stable/c/009831768faeca3fb5950ce63f1b49594ec82389
- https://git.kernel.org/stable/c/464bbb844ba5b68e038220c34019069a0a9f1581
- https://git.kernel.org/stable/c/6f52370970ac07d352a7af4089e55e0e6425f827
- https://git.kernel.org/stable/c/a8a1c7621127a15a02494b96ee376406c064237b
- https://git.kernel.org/stable/c/acb060bc2609c2eab49263968be59c7d59d497bc
- https://git.kernel.org/stable/c/adf0de36e52a48681eb58cbd7cbf6c8d200caa2b
- https://git.kernel.org/stable/c/cd8bcec2de5e24e05c34c9391940fda6f50e79b4