Linux kernel RDS over InfiniBand (FRMR registration before connection establishment): An RDS sendmsg carrying

Impact

An RDS sendmsg carrying RDS_CMSG_RDMA_MAP parses the control message and starts fast-registration memory-region work before the RDMA connection exists, dereferencing a NULL rdma_cm_id to reach its queue pair. The existing guard only checked whether the connection object was present, not whether it had a cm_id. Memory registration executing against a connection that has not been established is registration outside any established security context - and the immediate effect is that an unprivileged tenant crashes the node with one sendmsg.

Who can reach it

Local, unprivileged. One sendmsg with RDS_CMSG_RDMA_MAP on a freshly created outgoing RDS connection.

What to do

Kernel update strengthening the guard in rds_ib_reg_frmr() to check the cm_id. Blacklist rds/rds_rdma - the fastest fix for a module you almost certainly do not need.

References

Related entries

• HPE iLO 6 (denial of service): An unauthenticated attacker on an adjacent network can knock out iLO 6 availabilityCVE-2026-63457 · HPE iLO 6 (denial of service)Medium
• Dell OpenManage Enterprise: XML external entity processing exposes information to a low-privileged userCVE-2026-70423 · Dell OpenManage Enterprise (XML external entity processing)Medium
• Dell OpenManage Enterprise: path traversal exposes information to a low-privileged remote userCVE-2026-70424 · Dell OpenManage Enterprise (path traversal in a restricted-directory check)Medium
• Arista EOS: DHCP relay forwards replies from unconfigured servers, allowing client config spoofingCVE-2026-73437 · Arista EOS DHCP relay (helper-address source validation)Medium
• Dell OMSA: authenticated path traversal lets a low-privileged user read files off the nodeCVE-2026-81453 · Dell OpenManage Server Administrator (path traversal, authenticated)Medium
• RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NIC: RNICs cacheNCVD-2019-003-rnic-on-board-sram-metadata-cach · RNIC on-board SRAM metadata cache (page table entries, QP context) - most widely deployed RDMA NICMedium