Linux kernel (drivers/infiniband/sw/rxe): Two failed shared-receive-queue resizes in a row panic the node. The first

Impact

Two failed shared-receive-queue resizes in a row panic the node. The first failure leaves the queue pointer null, and the second call dereferences it while validating attributes - a deterministic, unprivileged kernel crash that takes the whole shared host down.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on a node with soft-RoCE (rdma_rxe) loaded: call the standard SRQ-modify verb twice with a size that makes the queue reallocation fail. Entirely tenant-controlled, no race to win, no fabric peer needed. Hardware HCAs do not run this code.

What to do

No fixed release is published in this record - apply the listed stable fix commits or run a current stable kernel. Interim: blacklist/unload rdma_rxe unless soft-RoCE is deliberately in use, and keep /dev/infiniband/* out of containers that do not need verbs.

References