Linux kernel RDMA/hns: reserved QP destroyed twice on error paths, corrupting a kernel list

Impact

The hns RoCE driver's reserved QP could be destroyed once in free_mr_init() and again in hns_roce_exit(), producing list_del corruption with a LIST_POISON1 next pointer and a WARN in __list_del_entry_valid, reached through the driver's reset-notify path. On a HiSilicon-NIC node this is the RDMA provider for the fabric, so the damage lands on the interconnect: a corrupted kernel list during driver reset or teardown risks a host crash and takes the node's RoCE traffic - and any collective running across it - down with it. The trigger in the published trace is an error flow inside driver init during a hardware reset, not an operation a tenant issues, so treat this as a reliability and crash-robustness fix rather than something an attacker drives on demand. Only hosts with hns_roce_hw_v2 hardware are affected.

Who can reach it

Local, and in practice not directly attacker-driven: the path runs during hns RoCE driver initialization after a hardware reset notification. A local user cannot be shown to reach it from the record as published.

What to do

Take a stable kernel carrying commits 067ca15be8b8, 10b083dbba22, c6957b95ecc5, dab173bae330 or fc8b0f5b16ba and reboot the affected nodes. No module reload or runtime mitigation covers it, and nodes with no HiSilicon RoCE hardware need no action.

References

Related entries

• Linux kernel (drivers/iommu/intel): VT-d tore the device off the I/O page-fault queue before the hardware had stoppedCVE-2025-38594 · Linux kernel (drivers/iommu/intel)High
• Linux kernel Xen gntdev: dma-buf export installs the fd before setup, giving a use-after-freeCVE-2025-38595 · Linux kernel Xen gntdev (dmabuf_exp_from_pages fd_install ordering)High
• Linux kernel (net/tls): KTLS assumes it owns the TCP receive queue. When another reader drains bytes first, the oldCVE-2025-38616 · Linux kernel (net/tls)High
• Linux kernel (net/xfrm): If the task is preempted onto another CPU during SA lookup, a hit in the per-CPU state cacheCVE-2025-38675 · Linux kernel (net/xfrm)High
• Linux kernel AMD IOMMU: one-byte stack buffer overflow parsing an oversized IVRS cmdline optionCVE-2025-38676 · Linux kernel iommu/amd (ivrs_acpihid kernel command line parsing)High
• Linux kernel (drivers/gpu/drm/xe): Xe frees data that its exported dma-fences still point at - notably the timelineCVE-2025-38703 · Linux kernel (drivers/gpu/drm/xe)High