Linux kernel (drivers/infiniband/core): An unprivileged tenant corrupts RDMA connection-manager state and lands a

Impact

An unprivileged tenant corrupts RDMA connection-manager state and lands a use-after-free. An address-resolve call that should have been rejected outright still overwrites the source address of a listening connection id, which later makes cancellation walk a list it does not own - freed memory is read and linked into live kernel lists.

Who can reach it

Any process with /dev/infiniband/rdma_cm (ucma) inside a tenant container: put an id into LISTEN, then issue a resolve on the same id, then destroy it. Plain write() calls on the device, no capabilities and no cooperating peer required. Provider-independent, so soft-RoCE nodes are exposed too.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: drop /dev/infiniband/rdma_cm from tenant containers that do not need connection-manager access.

References