Executive brief
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) transport for RPC services can cause system instability. Under conditions of high memory pressure, certain network operations may fail to clean up properly, leading to a permanent 'hang' or freeze of background system tasks. This can result in a denial of service where the affected system becomes unresponsive to network requests or fails to close connections correctly.
Technical details
A reference counting error exists in the xprtrdma implementation within the Linux kernel's SUNRPC subsystem. Specifically, in the rpcrdma_post_recvs() function, if a work request fails to be created (e.g., due to memory allocation failure) or the function exits early, the 're_receiving' counter is not decremented. This prevents rpcrdma_xprt_drain() from completing because the counter never reaches zero, causing the rpcrdma_xprt_disconnect() process to hang indefinitely. This issue is particularly prevalent on systems under high memory pressure and results in a kernel thread deadlock (state D). Patches have been released across multiple stable kernel branches to ensure the counter is decremented on all exit paths.
Affected products
- Linux Linux kernel 5.13 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9
Timeline
- 2026-02-23: other: Vulnerability fix authored
- 2026-05-08: disclosed: CVE published
- 2026-05-08: advisory
References
- https://git.kernel.org/stable/c/49f53ee4e25297d886f14e31f355ad1c2735ddfb
- https://git.kernel.org/stable/c/74c39a47856bddcde7874f2196a00143b5cd0af9
- https://git.kernel.org/stable/c/7b6275c80a0c81c5f8943272292dfe67730ce849
- https://git.kernel.org/stable/c/7ea69259a60a364f56cf4aa9e2eafb588d1c762b
- https://git.kernel.org/stable/c/8127b5fec04757c2a41ed65bca0b3266968efd3b
- https://git.kernel.org/stable/c/8cb6b5d8296b1f99a8d36849901ebabfe3f749db
- https://git.kernel.org/stable/c/dc3ebd7e2d73dbd4d317785735ffa6c4a6384ddf