Linux kernel (drivers/infiniband/sw/siw): A remote peer turns a connection drop into a kernel use-after-free. The

Impact

A remote peer turns a connection drop into a kernel use-after-free. The driver lets queue-pair destruction return while its own connection-manager work still holds references, so the RDMA core frees the QP and the late work handler then operates on freed memory. Rated critical and network-reachable by the kernel CNA.

Who can reach it

A peer on the fabric resets or drops the TCP connection at the moment the local side is tearing the QP down - the upstream report comes from ordinary NFS-over-RDMA testing, so no exotic crafting is needed, and no local credentials are involved. Requires the siw (soft-iWARP) module.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: unload/blacklist siw unless soft-iWARP is deliberately in use, and limit which peers can open iWARP connections to the node.

References