Executive brief
A bug in the Linux kernel's RDMA (Remote Direct Memory Access) address resolution module can trigger a kernel warning when device acquisition fails during asynchronous address resolution. While not a direct security vulnerability, this warning can lead to kernel instability and potential denial of service if triggered repeatedly. The issue occurs in code responsible for managing RDMA device associations.
Technical details
The vulnerability is a logic error in the RDMA connection management (cma) module. When cma_acquire_dev_by_src_ip() fails during addr_handler() processing, the code unconditionally invokes rdma_restrack_add() with a resource structure containing a NULL device pointer. This triggers a WARN_ON assertion in res_to_rt() that checks for non-NULL device pointers. The fix conditionally calls rdma_restrack_add() only after successful device acquisition. The attack vector is local, requiring ability to trigger address resolution failures through network-level manipulation or crafted inputs. No authentication is required as this operates within kernel space.
Affected products
- Linux Linux kernel before fix commit (exact version unknown)
Timeline
- 2026-09-17: disclosed