Linux kernel (drivers/infiniband/core): The iWARP connection manager frees the work objects it is currently executing

Impact

The iWARP connection manager frees the work objects it is currently executing from. If the last reference to a connection id is dropped inside an event handler, that handler's own work item is freed underneath the workqueue, corrupting kernel workqueue internals rather than just one connection. Rated critical and network-reachable by the kernel CNA.

Who can reach it

Driven by connection events from the fabric - a peer connecting, rejecting or disconnecting at the moment the local application destroys its connection id. No local credentials required; the remote side controls the timing half of the race. Applies to any iWARP-capable provider (irdma, siw, erdma, cxgb4), including tenant-initiated connections through /dev/infiniband/rdma_cm.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: disable iWARP providers not in use (unload siw / restrict irdma to RoCE mode where supported) and limit which peers can open iWARP connections to the node.

References