Executive brief
The Linux kernel's RDMA (Remote Direct Memory Access) subsystem contains a race condition in the netlink device interface when accessing memory region (MR) protection domain (PD) pointers. Since the PD can change due to memory region re-registration operations, concurrent access patterns create data races that could lead to use-after-free conditions, causing kernel crashes or potential privilege escalation on systems using RDMA hardware.
Technical details
This vulnerability is a race condition (CWE-362) in drivers/infiniband/core/nldev.c and related RDMA core components. The vulnerable code path accesses mr->pd->device and mr->pd->res.id without proper synchronization, but the PD pointer can be reassigned during memory region re-registration (rereg_mr operation). The fix replaces direct PD device access with mr->device and introduces READ_ONCE() barriers for PD pointer reads, plus adds an rdma_restrack_sync() function to serialize netlink dumps with PD changes. Attack requires local network access to the RDMA subsystem and is reachable without elevated privileges initially, but exploitation could lead to kernel memory corruption. Patches are available in Linux kernel stable branches.
Affected products
- Linux Linux kernel Multiple versions; patched in stable branches including 4.14.y, 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, and later
Timeline
- 2026-08-15: disclosed: CVE-2026-74334 published on NVD
- 2026-06-03: patched: Upstream fix committed by Jason Gunthorpe (commit 50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3)
- 2026-09-14: patched: Backported to Linux stable trees