Executive brief
The Linux kernel's NFS over RDMA (Remote Direct Memory Access) transport layer fails to properly validate the creation of a memory region used for padding write operations. If this memory region creation fails during connection setup, the transport is incorrectly marked as connected, leading to a null pointer dereference when a subsequent read operation attempts to use the uninitialized memory region. This can cause a kernel crash on NFS/RDMA clients.
Technical details
The vulnerability exists in the xprtrdma subsystem (net/sunrpc/xprtrdma/verbs.c) in the rpcrdma_xprt_connect() function. The frwr_wp_create() function creates a singleton memory region for encoding padding on non-XDR-aligned write chunks, but its return value indicating failure was not checked. If frwr_wp_create() fails after other connection setup succeeds, the function still returns success, allowing xprt_rdma_connect_worker() to set XPRT_CONNECTED. Subsequently, when rpcrdma_encode_write_list() attempts to use the write-pad memory region without NULL checking, it dereferences a NULL pointer and causes a kernel panic. The attack vector is local: this can only be triggered by an NFS/RDMA client experiencing local memory region allocation, DMA mapping, or post-send failures during connect/reconnect. The fix adds a return value check on frwr_wp_create() and fails the connection attempt with -ENOTCONN if it returns an error, allowing the normal reconnect path to retry.
Affected products
- Linux Linux kernel Linux 5.0 through 6.19 (and earlier versions with xprtrdma subsystem)
Timeline
- 2026-08-15: disclosed
- 2026-06-04: patched: Upstream fix committed by Chuck Lever