Executive brief
A vulnerability was identified in the Linux kernel's Reliable Datagram Sockets (RDS) implementation over InfiniBand. During a failed connection setup, the system could leave behind a 'stale' reference to memory that has already been freed. This could lead to system instability or crashes if the system later attempts to shut down the connection and tries to access that invalid memory location.
Technical details
A memory management flaw exists in net/rds/ib_cm.c within the Linux kernel. When rds_ib_setup_qp() fails after allocating 'i_sends' but before 'i_recvs', the error handling path calls vfree(ic->i_sends) without setting the pointer to NULL. Because the RDS IB teardown path is designed to handle partial startups by checking for NULL pointers, a subsequent shutdown attempt will treat the stale 'i_sends' pointer as valid, leading to a use-after-free or double-free condition. The fix involves explicitly setting ic->i_sends to NULL after vfree() in the sends_out label.
Affected products
- Linux Linux Kernel 3b12f73a5c29 to 6.9.3
Timeline
- 2026-05-29: disclosed: Patch submitted by Yuqi Xu
- 2026-06-19: patched: Commits merged into stable branches
- 2026-07-01: advisory: CVE published
References
- https://git.kernel.org/stable/c/1d4ec754ee3871f7e3670c67bb0298c9c5760926
- https://git.kernel.org/stable/c/20cf0fb715c41111469577e85e35d15f099473e0
- https://git.kernel.org/stable/c/27040bbca289a704eafcacca167d310c6ce2b1bc
- https://git.kernel.org/stable/c/29d940026dce39e3018dab6f67c9427249321270
- https://git.kernel.org/stable/c/2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b
- https://git.kernel.org/stable/c/66cccec111421a10efdc2c74499d15b93e7acae5
- https://git.kernel.org/stable/c/e7cf30aa5f1fc6c2a86df65df8b731df20e44d79