Executive brief
The Linux kernel's RDMA/irdma driver manages network-attached memory regions used for high-speed data queue operations. A vulnerability allowed userspace applications to prematurely deregister memory regions while the kernel was still actively using them, potentially causing the system to access invalid memory and leading to denial of service or privilege escalation.
Technical details
The vulnerability is a use-after-free in the RDMA/irdma driver's handling of memory regions (MRs) that back Queue Pair (QP), Completion Queue (CQ), and Shared Receive Queue (SRQ) rings. The root cause is insufficient refcounting on user-mode allocated MRs. A userspace application could deregister an MR while kernel structures still held references to it, enabling access to freed memory. The fix adds refcount_inc() when associating an MR with a queue ring and refcount_dec() during resource cleanup, preventing premature deregistration. Attack vector is local and requires userspace RDMA capability.
Affected products
- Linux Linux kernel Affected versions across multiple stable series (2.6.11 through 7.2)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix committed upstream; available in stable kernel versions