Database/Firmware, BMC & network fabric
Linux kernel InfiniBand core dmabuf umem (GPUDirect RDMA path): When mapping a dmabuf-backed RDMA memory region fails
Impact
When mapping a dmabuf-backed RDMA memory region fails, the dmabuf is unpinned immediately but the pinned flag is left set, so release unpins it a second time. This is the dmabuf path that GPUDirect RDMA uses to register GPU memory for the NIC - a double-unpin here corrupts the pinning state of buffers that sit between GPU memory and the fabric, exactly the code an operator most wants to be boring.
Who can reach it
Local, low-privileged - a tenant process registering GPU memory for RDMA via dmabuf, able to induce a mapping failure (resource pressure, invalid parameters).
What to do
Upgrade the host kernel to 7.0 or a stable backport (6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6). Rolling reboot of GPU nodes using GPUDirect RDMA over dmabuf.
References
Related entries
- Linux bnxt_en driver (RSS context delete logic): RSS contexts are not always freed in firmware when the driver deletesCVE-2026-43260 · Linux bnxt_en driver (RSS context delete logic)High
- Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init): If the copy_to_user() that returns the SRQCVE-2026-45852 · Linux kernel Soft-RoCE shared receive queue (rdma_rxe, rxe_srq_from_init)High
- Linux kernel (drivers/infiniband/sw/rxe): The soft-RoCE retransmit and ack timers race against queue-pair destructionCVE-2026-45910 · Linux kernel (drivers/infiniband/sw/rxe)High
- Linux kernel RDS RDMA (memory-region cleanup on cookie copy failure): Once __rds_rdma_map() has handed theCVE-2026-46053 · Linux kernel RDS RDMA (memory-region cleanup on cookie copy failure)High
- Linux kernel (drivers/infiniband/hw/mana): The userspace ABI lets a tenant point several work queues at the sameCVE-2026-46117 · Linux kernel (drivers/infiniband/hw/mana)High
- Linux kernel (drivers/infiniband/hw/mana): The RSS hash-key length arrived from the userspace ABI structure and wentCVE-2026-46145 · Linux kernel (drivers/infiniband/hw/mana)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.