Executive brief
A vulnerability in the Linux kernel's RDMA driver for Emulex OneConnect adapters could allow a local user to crash the system. The issue occurs during specific error-handling routines where the system attempts to access memory that has not yet been set up. This results in a system crash (kernel panic), impacting the availability of the server.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's ocrdma driver within the drivers/infiniband/hw/ocrdma/ocrdma_verbs.c file. The function ocrdma_copy_pd_uresp() attempts to reference pd->uctx during error cleanup paths (ucopy_err and dpp_map_err). However, pd->uctx is not initialized until late in the function's execution. If an error occurs prior to this initialization, the kernel attempts to dereference a NULL pointer, leading to a kernel panic. The fix involves using the local uctx variable which is correctly populated earlier in the function. This issue affects systems using Emulex OneConnect IBoE RDMA adapters.
Affected products
- Linux Linux Kernel ocrdma driver
Timeline
- 2026-04-28: other: Patch authored
- 2026-05-28: disclosed: CVE published
References
- https://git.kernel.org/stable/c/34fbf48cf3b410d2a6e8c586fa952a36331ca5ba
- https://git.kernel.org/stable/c/75fc130664ae324e7b2f9ad3630e0f175e9ca6c8
- https://git.kernel.org/stable/c/8832626a483439e207734e027afff322ccdf726e
- https://git.kernel.org/stable/c/e01a957561f663d3b68d2fd233a4502e3367efcd
- https://git.kernel.org/stable/c/ec44c00a4fe1327efa35083f98b39c01cb535a51