Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, so

Impact

The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, so RDMA CM events that arrive after the QP is gone land on freed memory. A peer that manipulates connection establishment gets a use-after-free inside the host's RDMA connection path - kernel memory corruption on a compute node driven from the fabric.

Who can reach it

This is initiator-side, driven by the remote end of the RDMA connection: a target (or anything that can answer/reject/stall CM traffic on the fabric) that forces errors during connection establishment causes CM events to be delivered after the QP teardown. It matters wherever your nodes connect NVMe/RDMA to a target you do not fully control, or where a tenant sits on the same RDMA fabric and can inject CM traffic. Requires nvme-rdma in use; no local privilege on the initiator is needed.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: restrict which targets initiators may connect to, and segment the RDMA fabric so tenant workloads cannot reach the CM path used for storage connections.

References