Executive brief
The Linux kernel's RDMA-over-TCP transport module (svcrdma) handles network address changes for RDMA listeners. When an address change event occurs and the kernel fails to allocate a replacement listener, it leaves a dangling pointer that gets dereferenced during shutdown, causing a crash or potential memory corruption. Systems using RDMA for NFS or other network services could experience unexpected failures.
Technical details
This is a use-after-free vulnerability in the svcrdma kernel module's RDMA connection management code. When svc_rdma_listen_handler() processes an RDMA_CM_EVENT_ADDR_CHANGE event, it attempts to create a replacement listener connection ID (cm_id) and signals the RDMA core to destroy the old one. If the allocation of the replacement fails, the sc_cm_id pointer still references the old cm_id that the RDMA core is about to free. Later, when svc_rdma_detach() calls rdma_disconnect() on this pointer during listener teardown, it dereferences freed memory. The fix clears sc_cm_id to NULL on allocation failure and adds a NULL check before dereferencing it in rdma_disconnect().
Affected products
- Linux Linux kernel All versions with svcrdma ADDR_CHANGE handling (approximately 5.2 and later)
Timeline
- 2026-09-11: disclosed: Published on NVD and stable kernel repositories
- 2026-05-27: patched: Upstream fix committed by Chuck Lever