Linux kernel Soft-RoCE completer (rdma_rxe, rxe_comp_queue_pkt): An inbound response packet is queued to the completer

Impact

An inbound response packet is queued to the completer before the code dereferences the same skb to bump a counter. If the completer task is already running on another CPU it can free the skb first, so the counter update reads freed memory. The trigger is a remote packet arriving at the right moment, which means an attacker who can send RoCE traffic at a node - a co-tenant on the same L2 fabric, since RoCEv2 is just UDP/4791 - can drive a kernel use-after-free with no credential. The kernel CNA rates it network, unauthenticated, full CIA.

Who can reach it

Remote and unauthenticated. Any host that can put RoCEv2 packets onto the node's fabric interface, including a container on another node in the same tenant network if RoCE is not segmented.

What to do

Kernel update reordering the counter access ahead of the enqueue. Practical short-term control: unload rdma_rxe on nodes that have real RDMA NICs and do not need software RoCE, and enforce a fabric ACL so UDP/4791 is only accepted from the cluster's own RDMA subnet rather than from any tenant-routable network.

References