Linux kernel irdma: failed memory-region re-registration leaves a stale umem, leading to double free

Impact

In the Intel irdma provider, if irdma_rereg_mr_trans() fails after allocating a new umem, it releases the umem but leaves iwmr->region set. The failure is returned to userspace, the application then calls ibv_dereg_mr() as it should, and the dereg path sees a non-NULL umem and calls ib_umem_release() a second time. A double free of pinned-memory tracking state is a strong kernel heap primitive, and the trigger is an ordinary verbs call sequence that a tenant can provoke deliberately. This matters on fabric-attached GPU nodes because RDMA device files are handed to training jobs for NCCL/RoCE traffic, so the attacker is a normal tenant workload rather than an administrator. Exposure is limited to nodes using Intel RDMA-capable NICs with the irdma driver loaded - Mellanox/NVIDIA ConnectX fleets are not affected by this id.

Who can reach it

Local user with access to an RDMA verbs device (/dev/infiniband/uverbsN), which on GPU clusters typically means any pod granted RDMA resources. Authenticated local access only; the memory region re-registration path is reachable from unprivileged userspace verbs calls.

What to do

Patch to a stable kernel carrying the fix (backports on five branches in the record) and reboot the affected nodes; the irdma module can in principle be unloaded and reloaded, but not while RDMA jobs hold devices, so in practice this is a drain and reboot. Nodes that do not use Intel RDMA can confirm with lsmod | grep irdma and defer. No vendor advisory beyond the kernel commits is present in the record, so no fixed version is quoted here.

References

Related entries

• Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path): When mapping a dmabuf-backed RDMA memory region failsCVE-2026-43128 · Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path)High
• Linux bnxt_en driver (RSS context delete logic): RSS contexts are not always freed in firmware when the driver deletesCVE-2026-43260 · Linux bnxt_en driver (RSS context delete logic)High
• Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init): If the copy_to_user() that returns the SRQCVE-2026-45852 · Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init)High
• Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE retransmit and ack timers race against queue-pair destructionCVE-2026-45910 · Linux kernel (drivers/infiniband/sw/rxe)High
• Linux kernel RDS RDMA (memory-region cleanup on cookie copy failure): Once __rds_rdma_map() has handed theCVE-2026-46053 · Linux kernel RDS RDMA (memory-region cleanup on cookie copy failure)High
• Linux kernel (drivers/infiniband/hw/mana): The userspace ABI lets a tenant point several work queues at the sameCVE-2026-46117 · Linux kernel (drivers/infiniband/hw/mana)High