Executive brief
The Linux kernel's RDMA (Remote Direct Memory Access) subsystem contains a use-after-free vulnerability in the queue pair (QP) query function. When a QP is being destroyed while another thread queries it via netlink, the query function can access memory that has already been freed, potentially causing a system crash or undefined behavior. This affects systems using RDMA networking, particularly InfiniBand deployments.
Technical details
The vulnerability is a use-after-free in the ib_query_qp() function within the RDMA/core subsystem. The root cause is a synchronization race condition: during QP destruction via ib_destroy_qp_user(), the rdma_restrack_del() call happens too late—after vendor-specific resources have already been freed. Meanwhile, the netlink query path only holds an rdma_restrack_get() reference, allowing concurrent queries to access freed memory. The fix moves rdma_restrack_begin_del() to the start of ib_destroy_qp_user() to ensure all QP accesses complete before resources are freed and the QP is removed from the tracking database. The vulnerability requires no authentication and can be triggered by unprivileged code able to issue netlink queries against QPs being concurrently destroyed.
Affected products
- Linux Linux kernel
Timeline
- 2026-09-17: disclosed