Linux kernel (drivers/infiniband/ulp/ipoib): A PKEY child interface created over netlink comes up with multiple TX/RX

Impact

A PKEY child interface created over netlink comes up with multiple TX/RX queues even when the parent device supports only one, and the first packet sent on it dereferences a NULL pointer and panics the node. PKEY partitions are exactly how an InfiniBand fabric separates tenants, so the isolation mechanism itself becomes the crash trigger.

Who can reach it

Two-stage: the partition child interface is created by the operator or orchestration over netlink (needs CAP_NET_ADMIN), after which any unprivileged workload sending traffic on that interface panics the node. Conditional on legacy IPoIB with PKEY child interfaces on a device that supports a single queue.

What to do

Update to 5.4.232 / 5.10.168 / 5.15.94 / 6.1.12 or later. Interim: create PKEY child interfaces through the legacy sysfs path rather than netlink, or avoid PKEY child interfaces on single-queue IPoIB devices until patched.

References