Linux kernel RDMA restrack: memory-region deletion fails to release the tracker, leaking task structs

Impact

Deleting an RDMA memory region did not release its restrack entry, so the associated task struct was never freed. A workload that repeatedly registers and deregisters memory regions leaks unreclaimable kernel memory until the node is under memory pressure or OOM. This is an availability problem rather than an escalation one, but MR register/deregister churn is exactly what NCCL, UCX and RDMA-backed storage clients do on every job, so a long-lived GPU node running back-to-back distributed jobs accumulates the leak without anyone issuing anything unusual. The failure mode is a node that degrades over days and has to be drained mid-job.

Who can reach it

Local, authenticated: any process with access to the RDMA verbs devices (/dev/infiniband/uverbs*) - in practice any tenant pod granted RDMA device access for InfiniBand or RoCE traffic. No privilege beyond that is needed, and the leak also accrues from ordinary legitimate use.

What to do

Move to a fixed stable kernel (commits in the record) and reboot. Fabric-side drivers live in the kernel image, so this is a drain-and-reboot per node. Short of that, the only mitigation is operational: watch kernel slab growth on nodes with heavy RDMA memory-region churn and recycle them before they hit memory pressure.

References

Related entries

• TPM 2.0 reference implementation: Out-of-bounds write in `CryptParameterDecryption`CVE-2023-1017 · TPM 2.0 reference implementationHigh
• AMD Secure Processor - TOCTOU race: A time-of-check-to-time-of-use race in the ASP lets an attacker swap a valueCVE-2023-20548 · AMD Secure Processor - TOCTOU raceHigh
• NVIDIA DGX BMC (IPMI handler): Buffer overflow in the IPMI handler of the NVIDIA DGX BMCCVE-2023-25505 · NVIDIA DGX BMC (IPMI handler)High
• AMD Secure Processor - XGMI Trusted Agent (TOCTOU): A TOCTOU race in the ASP's XGMI Trusted Agent lets an attackerCVE-2023-31324 · AMD Secure Processor - XGMI Trusted Agent (TOCTOU)High
• Insyde InsydeH2O (SystemFirmwareManagementRuntimeDxe, GetImage method): The firmware reads a runtime UEFI variableCVE-2023-34195 · Insyde InsydeH2O (SystemFirmwareManagementRuntimeDxe, GetImage method)High
• AMI MegaRAC SPx 12 / SPx 13 (BMC): Untrusted pointer dereference in the BMC that a low-privileged actor can turnCVE-2023-34332 · AMI MegaRAC SPx 12 / SPx 13 (BMC)High