Executive brief
The Linux kernel's InfiniBand (RDMA) core module could execute freed code when unloading if RCU callbacks were still pending. This could allow local code execution during module cleanup, potentially giving an attacker a window to corrupt kernel memory or crash the system.
Technical details
The vulnerability is a use-after-free in the ib_core (InfiniBand RDMA core) module's cleanup path. The function put_gid_ndev() is registered as an RCU callback via call_rcu() but is implemented directly in the ib_core module code. During module unload, the code calls synchronize_rcu() and destroys workqueues, but does not wait for already-queued RCU callbacks to complete. This allows RCU to invoke put_gid_ndev() after the ib_core module text has been unmapped, leading to execution of freed memory. The fix adds rcu_barrier() before the final cleanup to ensure all pending RCU callbacks execute while the module is still loaded. Exploitation requires the ability to unload and reload ib_core, which is typically restricted to root.
Affected products
- Linux Linux Kernel Multiple versions; fix applied to stable branches linux-4.4.y through linux-7.2.y and rolling branches
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched