Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, so

CVSS 9.8CVE-2021-47378Kernel, userspace & hypervisorcurated

Impact

The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, so RDMA CM events that arrive after the QP is gone land on freed memory. A peer that manipulates connection establishment gets a use-after-free inside the host's RDMA connection path - kernel memory corruption on a compute node driven from the fabric.

Who can reach it

This is initiator-side, driven by the remote end of the RDMA connection: a target (or anything that can answer/reject/stall CM traffic on the fabric) that forces errors during connection establishment causes CM events to be delivered after the QP teardown. It matters wherever your nodes connect NVMe/RDMA to a target you do not fully control, or where a tenant sits on the same RDMA fabric and can inject CM traffic. Requires nvme-rdma in use; no local privilege on the initiator is needed.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: restrict which targets initiators may connect to, and segment the RDMA fabric so tenant workloads cannot reach the CM path used for storage connections.

References

https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994 https://nvd.nist.gov/vuln/detail/CVE-2021-47378

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.