Linux kernel (drivers/infiniband/core): A heap use-after-free in the userspace RDMA connection-manager interface.

Impact

A heap use-after-free in the userspace RDMA connection-manager interface. Multicast state is scanned without a lock while another thread is freeing it, so a tenant reads and follows a dangling pointer in kernel memory - the classic starting point for local privilege escalation out of a container.

Who can reach it

Any process holding /dev/infiniband/rdma_cm (ucma) - no capabilities needed. One thread leaves a multicast group while another destroys the CM context; syzkaller reaches it through plain write() calls on the device. Provider-independent: it works over soft-RoCE as well as real HCAs, so a node with rxe loaded is exposed even without RDMA hardware.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: remove /dev/infiniband/rdma_cm from tenant containers (most workloads that only do verbs do not need the CM character device) and unload rdma_rxe if unused.

References