Executive brief
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) component can cause a system crash. This occurs when the system is under heavy stress, leading to internal memory corruption within the kernel's task scheduling logic. An exploit would result in a complete denial of service (system crash), impacting the availability of the server and any hosted operations.
Technical details
A race condition and list corruption vulnerability exists in the RDMA iWARP Connection Manager (iwcm) of the Linux kernel. The issue stems from the 'cm_event_handler' incorrectly using a free list for 'iwcm_work' structures while unconditionally calling 'queue_work()'. Because each work item is unique, the work handler can process and release an item back to the free list while it is still technically queued in the workqueue. Subsequent reuse of the memory (via INIT_WORK) leads to list corruption and a kernel BUG/Oops. This was specifically observed during stress testing with 'ucmatose' on Intel E830 hardware in iWARP mode. The fix involves removing the redundant internal 'work_list' and relying on the native workqueue management.
Affected products
- Linux Linux Kernel 6.19-rc4
Timeline
- 2026-01-12: disclosed: Initial patch submitted by Google developer
- 2026-05-27: advisory: CVE-2026-45898 published by NVD