Linux kernel (drivers/infiniband/sw/siw): Soft-iWARP memory-region allocation stores the memory object into the MR and

Impact

Soft-iWARP memory-region allocation stores the memory object into the MR and then frees it if ID allocation fails, leaving the MR pointing at freed memory that the error path immediately dereferences. A use-after-free on the memory-registration path, reachable without any RDMA hardware.

Who can reach it

An unprivileged process on a node with siw loaded registers memory regions until the ID allocator fails - a container can drive that with its own resource limits. No HCA, no fabric peer, no host root.

What to do

No fixed version is listed in the record - take the stable kernel carrying 30b9e92d0b5e (or 608a4b90ece0 / 3e22b88e02c1) and reboot. Interim: unload and blacklist siw where soft-iWARP is not required.

References