Executive brief
The Linux kernel's RDMA/hfi1 driver contains a resource cleanup bug that can corrupt the device allocation table when device initialization fails. If memory allocation fails during device setup, the driver incorrectly removes an unrelated device from the system, potentially causing system instability or device unavailability.
Technical details
The vulnerability exists in the hfi1_alloc_devdata() function in drivers/infiniband/hw/hfi1/init.c. When xa_alloc_irq() fails during device initialization, the function calls hfi1_free_devdata() for cleanup. However, hfi1_free_devdata() unconditionally removes the device from the unit table based on dd->unit, which remains zero-initialized if the device was never successfully added to the table. This causes an unrelated device at unit index 0 to be incorrectly removed from the allocation table. The fix ensures that rdmavt allocation is released and the function returns immediately via ERR_PTR() before the device enters the unit table, preventing the erroneous cleanup of other devices.
Affected products
- Linux Linux kernel affected versions prior to fix commit 2e3809ad8911f5d5581b3f046bd628417bface76
Timeline
- 2026-09-17: disclosed
- 2026-07-13: patched