Executive brief
A vulnerability in the Linux kernel's Reliable Datagram Sockets (RDS) protocol could allow an unprivileged user to crash the system. By sending a specific type of network message on systems using InfiniBand hardware, an attacker can trigger a kernel panic. This results in a complete system outage and denial of service.
Technical details
A NULL pointer dereference exists in net/rds/ib_send.c within the rds_ib_send_cqe_handler() function. The issue arises because rds_ib_xmit_atomic() programs masked atomic opcodes (IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD), but the completion handler rds_ib_send_unmap_op() failed to account for these specific opcodes in its switch statement. This causes the function to return a NULL message pointer while the send operation is still active, leading to a dereference of the NULL pointer in softirq context. An unprivileged user can trigger this via an AF_RDS sendmsg() call on hardware supporting masked atomics (such as Mellanox mlx4/mlx5).
Affected products
- Linux Linux Kernel 20c72bd5f5f9 to a0148342badd8c9b2e46551766a27cb76c82e715
Timeline
- 2026-06-06: other: Patch submitted by Weiming Shi
- 2026-06-09: patched: Mainline kernel patch committed
- 2026-06-24: disclosed: CVE published
References
- https://git.kernel.org/stable/c/0f22412a2f4fbbe0251c132abee045d15a90e5b6
- https://git.kernel.org/stable/c/0f7baa82a24813cdad0b06a6f8f07e4824af5ed5
- https://git.kernel.org/stable/c/34080db3e70ddf94c38512ad2331e3c3afca6cc1
- https://git.kernel.org/stable/c/4dd262f875e87653df50b138de1390ab0628e6b7
- https://git.kernel.org/stable/c/4fd34669558085bcb589aa2078a13b0ca79e360d
- https://git.kernel.org/stable/c/6e4615164d185a26badb2f376a2449f4d174a5f0
- https://git.kernel.org/stable/c/a0148342badd8c9b2e46551766a27cb76c82e715