Linux kernel (drivers/infiniband/ulp/rtrs): A remote client corrupts kernel linked lists on the RDMA block-storage

Impact

A remote client corrupts kernel linked lists on the RDMA block-storage server. An IB event handler is registered on every connection but never unregistered, so repeated connect/disconnect cycles leave stale handlers linked into device-wide lists - list corruption and stale-pointer execution on the target host, rated critical and network-reachable by the kernel CNA.

Who can reach it

Target-side and pre-authentication: whoever can reach the rtrs/rnbd server's listener drives it, entirely from the connection-establishment path (the CM request handler). Repeat connect/disconnect is the whole exploit. Applies to nodes exporting storage over rtrs/rnbd - if that listener is reachable from tenant networks, treat it as tenant-reachable.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: firewall the rtrs/rnbd server port to the storage network only, or stop exporting rtrs targets on affected hosts until patched.

References