Executive brief
The Linux kernel's RDMA over Converged Ethernet (RoCE) driver for Chelsio T4/T5 adapters contains a use-after-free vulnerability during device removal. When the device is removed, pending registration work may still be accessing device memory that has already been freed, potentially causing system crashes or memory corruption. This affects systems that use Chelsio InfiniBand/RDMA adapters.
Technical details
The vulnerability is a use-after-free (CWE-416) in the RDMA/cxgb4 driver. The c4iw_uld_state_change() function queues asynchronous work (reg_work) to register the RDMA device, but c4iw_remove() can free the device context (ctx->dev) while this work is still pending or executing, causing c4iw_register_device() to access freed memory. The fix adds a cancel_work_sync() call to synchronously cancel the pending registration work before device removal, and adds a null check to prevent double-freeing if registration work already tore down the device. This is a local vulnerability; no authentication or network access is required—only local code execution context on a system with an affected adapter.
Affected products
- Linux Linux kernel Multiple versions; patch applied to stable trees linux-4.14.y through linux-7.2.y and rolling branches
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched: Upstream commit a7100601aa1a39f799a566acce10db20eaf4b7f2; backported to stable series