Linux kernel (drivers/infiniband/sw/rxe): Soft-RoCE queue-pair cleanup drains send and receive work queues that a

Impact

Soft-RoCE queue-pair cleanup drains send and receive work queues that a partially failed create-QP never allocated, faulting in the kernel. Same shape as the other rxe unwind bug: a tenant that can make create-QP fail gets a reliable node crash, so one container can reboot a box full of other tenants' jobs.

Who can reach it

Local and unprivileged: reached from /dev/infiniband/uverbs* on an rdma_rxe (soft-RoCE) device by issuing a create-QP that fails after partial setup. No hardware adapter, no fabric peer. Conditional on rdma_rxe being loaded.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the drain-queue guard (commits da572f6313ae / d366642b3099). Interim: blacklist rdma_rxe where soft-RoCE is not needed, and remove /dev/infiniband from tenant containers.

References

Related entries

• Linux kernel (drivers/infiniband/sw/rxe): If soft-RoCE queue-pair creation fails partway, the unwind path runs cleanupCVE-2023-54028 · Linux kernel (drivers/infiniband/sw/rxe)Medium
• Linux kernel (drivers/infiniband/sw/rxe): When soft-RoCE queue-pair initialisation fails, the QP structure is left fullCVE-2021-47078 · Linux kernel (drivers/infiniband/sw/rxe)High
• Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE queue-pair init error path frees the send-queue ring and leavesCVE-2021-47616 · Linux kernel (drivers/infiniband/sw/rxe)High
• Linux kernel (drivers/infiniband/sw/rxe): A tenant gets a double free in the kernel heap through a failed memoryCVE-2022-50543 · Linux kernel (drivers/infiniband/sw/rxe)High
• Linux kernel (drivers/infiniband/sw/rxe): Use-after-free from a race between a busy soft-RoCE task and its ownCVE-2025-40061 · Linux kernel (drivers/infiniband/sw/rxe)High
• Linux kernel (drivers/infiniband/sw/rxe): Two failed shared-receive-queue resizes in a row panic the node. The firstCVE-2025-68379 · Linux kernel (drivers/infiniband/sw/rxe)High