Linux kernel (drivers/infiniband/core): The RDMA connection-manager state machine can be driven in a circle so two

Impact

The RDMA connection-manager state machine can be driven in a circle so two address-resolution requests are outstanding for the same connection ID. Cancellation only removes the first, so the ID is freed while the second request is still queued, and the address handler then runs against freed memory - a use-after-free in the shared connection-setup path.

Who can reach it

A tenant container holding /dev/infiniband/rdma_cm drives rdma_resolve_addr through the address-error/rebind flow twice and then destroys the ID. Timing is helped by whatever the fabric does to route resolution, but no fabric peer cooperation is required and no host root is needed.

What to do

No fixed version is listed in the record - take the stable kernel carrying 9a085fa9b7d6 (or 03d884671572 / 305d568b72f1) and reboot. Interim: remove /dev/infiniband/rdma_cm from containers that do not need connection management (many RDMA workloads only need uverbs).

References