Executive brief
The Linux kernel's HNS RDMA driver experiences a denial-of-service condition when hardware fails to respond to command mailbox requests. Abnormal hardware triggers unlimited error log messages, overwhelming system logs and potentially causing the system to crash due to log buffer exhaustion or resource starvation.
Technical details
The RDMA/hns driver's hns_roce_cmd_mbox() function is the command interface between the driver and hardware. When hardware experiences abnormal conditions and fails to respond, error handling code in the driver emits unlimited ibdev_err() and ibdev_warn() messages without rate limiting. This causes a log flood that can exhaust system resources and trigger a kernel panic. The fix replaces unbounded error logging calls with their ratelimited variants (ibdev_err_ratelimited(), ibdev_warn_ratelimited()) in error paths following hns_roce_cmd_mbox() and its wrappers (hns_roce_create_hw_ctx, hns_roce_destroy_hw_ctx). The vulnerability is local to systems with HNS RDMA hardware and requires abnormal hardware behavior to trigger.
Affected products
- Linux Linux kernel 5.0 through 7.2 (RDMA/hns driver component)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched