Linux kernel RDMA core netlink (nldev_stat_set_counter_dynamic_doit): The dynamic-counter netlink setter bounded its

Impact

The dynamic-counter netlink setter bounded its index from above but not from below, so a negative index underflowed past the start of the counter array. It is reachable from the RDMA netlink admin surface, which in clusters that hand namespaced RDMA administration to tenant operators (or to a fabric-management sidecar) is not as far from the tenant as it looks.

Who can reach it

Local RDMA netlink message; requires the privilege to configure RDMA statistics counters in the namespace.

What to do

Kernel update changing the index to an unsigned type. Audit which workloads hold CAP_NET_ADMIN in their netns - on many clusters that capability is granted far more broadly than intended, and it is the gate on this and a family of similar nldev bugs.

References