Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE queue-pair init error path frees the send-queue ring and leaves

Impact

The soft-RoCE queue-pair init error path frees the send-queue ring and leaves the pointer dangling, so the final reference drop frees it a second time. A double free of an attacker-sized ring buffer is a strong heap-corruption primitive for escaping a container.

Who can reach it

An unprivileged process on a node with rdma_rxe loaded creates queue pairs whose initialisation fails after the send queue is allocated. No HCA, no fabric peer, no host root.

What to do

No fixed version is listed in the record - take the stable kernel carrying acb53e47db1f (or 84b01721e804) and reboot. Interim: unload and blacklist rdma_rxe on nodes that do not need soft-RoCE.

References