Linux kernel (drivers/infiniband/core): A 32-bit advance counter in the core RDMA block iterator wraps when a single

CVSS 7.8CVE-2023-53026Firmware, BMC & network fabriccurated

Impact

A 32-bit advance counter in the core RDMA block iterator wraps when a single scatter-gather entry needs more than 4GB of page-aligned coverage, and the iterator never terminates. Registering one very large memory region spins a CPU inside the kernel forever - a whole-node hang that every co-tenant on the box pays for, and it lives in core code shared by all RDMA drivers.

Who can reach it

Local: any tenant holding /dev/infiniband/uverbs* can register a large, misaligned memory region (the upstream trace is an EFA dmabuf registration with a 3GB SG entry and a 2GB page size) and hang the registering CPU. No fabric peer needed; the bug is in drivers/infiniband/core/verbs.c, so it applies across mlx5, efa, irdma and the rest.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the block-iterator overflow fix (commits 902063a9fea5 / d66c1d4178c2). Interim: cap tenant memory-registration size / locked-memory limits, and drop /dev/infiniband from containers that do not need native verbs.

References

https://git.kernel.org/stable/c/902063a9fea5f8252df392ade746bc9cfd07a5ae https://git.kernel.org/stable/c/d66c1d4178c219b6e7d7a6f714e3e3656faccc36 https://nvd.nist.gov/vuln/detail/CVE-2023-53026

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.