Executive brief
A race condition in the Linux kernel's RDMA transport layer can cause a null pointer dereference during device removal. When an InfiniBand device is removed while a notification is being registered, the kernel may attempt to invoke an uninitialized callback function, causing the system to crash. This affects systems using RDMA-over-Converged-Ethernet (RoCE) or other RDMA transports.
Technical details
The vulnerability is a race condition in the rpcrdma_rn_register() function in net/sunrpc/xprtrdma/ib_client.c. The function inserts a notification object into an xarray (rd_xa) via xa_alloc() before initializing the rn_done callback pointer. If device removal (rpcrdma_remove_one) races with registration, it can observe the notification object with a NULL rn_done pointer and attempt to call through it, causing a null pointer dereference and kernel panic. The fix involves setting rn_done before calling xa_alloc() to ensure atomic visibility: once the notification is visible in rd_xa, the callback is already initialized. If xa_alloc() fails, rn_done is cleared again to maintain the sentinel property used by rpcrdma_rn_unregister(). Patches are available in the Linux stable kernel trees.
Affected products
- Linux Linux kernel Multiple versions (see stable tree references for specific ranges)
Timeline
- 2026-09-16: disclosed: Published in NVD
- 2026-09-11: patched: Fix included in stable kernel releases by Greg Kroah-Hartman