Executive brief
A memory corruption vulnerability was identified in the Linux kernel's RDMA (Remote Direct Memory Access) driver for HiSilicon hardware. The issue occurs during specific error handling scenarios when creating network connections, where the system fails to properly lock internal data structures. This could lead to system instability or memory corruption, potentially affecting the reliability of high-performance networking operations.
Technical details
A race condition and potential memory corruption vulnerability exists in the hns_roce driver within the Linux kernel's RDMA subsystem. The function hns_roce_create_qp_common() fails to acquire necessary spinlocks (qp_list_lock) and CQ locks before calling hns_roce_qp_remove() during an error unwind flow. This violation of locking requirements can lead to concurrent access and corruption of the Queue Pair (QP) list or Completion Queue (CQ) structures. The vulnerability is triggered locally during failed QP creation attempts. Patches have been merged into multiple stable kernel branches to ensure proper lock acquisition using spin_lock_irqsave and hns_roce_lock_cqs.
Affected products
- Linux Linux kernel Fixed in 6.1, 6.6, 6.8, 6.9, and master branches
Timeline
- 2026-04-28: other: Patch authored by Jason Gunthorpe
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0c99acbc8b6c6dd526ae475a48ee1897b61072fb
- https://git.kernel.org/stable/c/1912f78798505dc9c637081bbddfbf1c22494c49
- https://git.kernel.org/stable/c/615d9d260c32bb678504ca96f29ae46f9d745155
- https://git.kernel.org/stable/c/fb4ae739811d467409bd07d0e36cfd4140f3d26a
- https://git.kernel.org/stable/c/fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb