Linux kernel (drivers/infiniband/hw/irdma): In the physical-buffer-list allocator, a chunk is freed while still linked

Impact

In the physical-buffer-list allocator, a chunk is freed while still linked on the PBLE info list, so the driver keeps walking and using freed memory. This is a use-after-free on the memory-registration path - a heap-grooming primitive for a container that wants host kernel code execution.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an irdma node registers memory regions until the host-memory-cache segment allocation fails. A container can create that pressure deliberately with its own memory cgroup, so the failure branch is attacker-reachable rather than incidental.

What to do

No fixed version is listed in the record - take the stable kernel carrying 11eebcf63e98 (or 1e11a39a82e9) and reboot. Interim: drop /dev/infiniband/* from untrusted containers on irdma nodes.

References