Linux kernel (drivers/infiniband/hw/irdma): In the physical-buffer-list allocator, a chunk is freed while still linked

CVSS 7.8CVE-2021-47614Firmware, BMC & network fabriccurated

Impact

In the physical-buffer-list allocator, a chunk is freed while still linked on the PBLE info list, so the driver keeps walking and using freed memory. This is a use-after-free on the memory-registration path - a heap-grooming primitive for a container that wants host kernel code execution.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an irdma node registers memory regions until the host-memory-cache segment allocation fails. A container can create that pressure deliberately with its own memory cgroup, so the failure branch is attacker-reachable rather than incidental.

What to do

No fixed version is listed in the record - take the stable kernel carrying 11eebcf63e98 (or 1e11a39a82e9) and reboot. Interim: drop /dev/infiniband/* from untrusted containers on irdma nodes.

References

https://git.kernel.org/stable/c/11eebcf63e98fcf047a876a51d76afdabc3b8b9b https://git.kernel.org/stable/c/1e11a39a82e95ce86f849f40dda0d9c0498cebd9 https://nvd.nist.gov/vuln/detail/CVE-2021-47614

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.