Linux kernel (drivers/infiniband/sw/rxe): A tenant gets a double free in the kernel heap through a failed memory

Impact

A tenant gets a double free in the kernel heap through a failed memory registration. When user MR setup fails, both the error path and the object cleanup release the same page-map allocation, giving the tenant a controllable allocator-corruption primitive rather than a simple crash.

Who can reach it

Tenant container holding /dev/infiniband/uverbs* on a node with soft-RoCE (rdma_rxe) loaded: call reg_mr with an address/length that makes the user-memory pinning fail, which the tenant chooses freely. Unprivileged and deterministic. Hardware HCAs do not use this code.

What to do

Update to a kernel carrying the fix (record cites 5.20-era mainline) or apply the listed stable commits. Interim: blacklist/unload rdma_rxe where soft-RoCE is not required, and remove /dev/infiniband/* from containers that do not use verbs.

References