Executive brief
The Linux kernel's RDMA/rxe driver can incorrectly reprocess network packets after a connection enters an error state, causing duplicate data delivery to applications. In RDMA-based messaging systems like RDS, this results in the same datagram being delivered hundreds of times to user space, corrupting data streams and violating the exactly-once delivery guarantee that applications rely on.
Technical details
This is a state machine logic error in the RDMA/rxe responder path. After a previous cleanup commit removed error-state handling from check_resource(), the do_complete() function still returns RESPST_CHK_RESOURCE when the QP enters error state, causing the responder loop to re-execute the current packet with fresh WQEs instead of consuming it. The vulnerable code path (send_data_in() → copy_data) processes the same packet once per remaining queued WQE, generating duplicate IB_WC_SUCCESS completions. When the RQ is exhausted, qp->resp.wqe becomes NULL and a NULL pointer dereference occurs in copy_data(). The attack vector is local/adjacent—a racing rdma_cm disconnect with receive processing—and affects any RC (Reliable Connection) ULP that assumes exactly-once delivery semantics. The fix changes do_complete() to return RESPST_CLEANUP for live packets, ensuring proper consumption.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-17: disclosed