Linux kernel RDMA/core: deleting an IB sub-device leaks a device reference on the -EOPNOTSUPP path

Impact

The netlink handler that deletes an IB sub-device takes a device reference with ib_device_get_by_index() before calling ib_del_sub_device_and_put(), but that function returned -EOPNOTSUPP without dropping the reference. Each rejected delete therefore pins the IB device structure forever. On a GPU fleet the IB devices are the InfiniBand or RoCE HBAs that carry collective traffic, and a leaked device reference means the driver can no longer be unbound or unloaded and the device cannot be cleanly torn down - so a node that needs an HCA driver reload for firmware or a fabric change has to be rebooted instead. The exposure is narrow: the path is the RDMA netlink sub-device management interface, not anything a tenant job touches.

Who can reach it

Local user holding the privilege to issue RDMA netlink device-management commands (CAP_NET_ADMIN in the relevant namespace) - in practice the host administrator or a fabric-management agent, not a tenant with a GPU pod. No remote or unauthenticated path in the record.

What to do

Update to a stable kernel carrying the fix and reboot the node; the leak is in ib_core, and once a reference has leaked the module cannot be unloaded, so a reboot is the only way to clear an already-leaked state. Until patched, avoid repeated RDMA netlink sub-device delete attempts against devices that do not support them. Only the upstream commits are in the record; no vendor advisory with a fixed version is present.

References

Related entries

• Dell OpenManage Enterprise: local low-privileged user escalates privileges on the console applianceCVE-2026-101213 · Dell OpenManage Enterprise (improper privilege management)High
• Linux kernel InfiniBand user MAD interface (ib_umad, /dev/infiniband/umad*): A process with access to the user MADCVE-2026-23243 · Linux kernel InfiniBand user MAD interface (ib_umad, /dev/infiniband/umad*)High
• Dell iDRAC Service Module (iSM) for Windows and Linux: Improper access control in the host-side iDRAC Service ModuleCVE-2026-23856 · Dell iDRAC Service Module (iSM) for Windows and LinuxHigh
• Linux kernel efa driver: admin-queue completion context used after free on command errorCVE-2026-31493 · Linux kernel RDMA/efa driver (admin queue completion context lifetime)High
• Linux kernel irdma: failed memory-region re-registration leaves a stale umem, leading to double freeCVE-2026-43120 · Linux kernel RDMA/irdma (rereg_user_mr memory-region re-registration)High
• Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path): When mapping a dmabuf-backed RDMA memory region failsCVE-2026-43128 · Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path)High