Linux kernel (drivers/infiniband/hw/irdma): Use-after-free on completion-queue teardown. The driver frees the CQ

Impact

Use-after-free on completion-queue teardown. The driver frees the CQ backing resources before it has stopped the interrupt path from processing completions against them, so an in-flight CQE lands in freed memory - a heap write primitive from an unprivileged tenant, not merely a crash.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel E810 / irdma node destroys a CQ while traffic is still arriving on the associated QP. The race window is widened by inbound fabric traffic, so a cooperating peer on the RDMA fabric makes it far easier to win. Requires the irdma module and Intel RDMA-capable NICs.

What to do

No fixed release is published in this record - apply the listed stable fix commits or move to a current stable kernel. Interim: if tenants do not need RDMA, drop /dev/infiniband/* from their containers; if they do, treat irdma nodes as untrusted-tenant boundary hosts and prioritize the kernel update.

References