Linux kernel (drivers/infiniband/sw/rxe): Use-after-free from a race between a busy soft-RoCE task and its own

Impact

Use-after-free from a race between a busy soft-RoCE task and its own teardown. A task that exhausts its work budget resets its state and reschedules itself, silently overwriting the draining state set by cleanup - so cleanup proceeds and frees objects the rescheduled task keeps using. Heap corruption reachable by an unprivileged tenant.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on a node with rdma_rxe loaded: keep a queue-pair saturated with work (which forces the task to hit its iteration limit) while destroying or disabling it. Inbound traffic from a peer on the fabric makes the busy state easy to sustain. rxe only.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: blacklist/unload rdma_rxe where soft-RoCE is not required, and drop /dev/infiniband/* from containers that do not use verbs.

References