Linux kernel (drivers/infiniband/core): The iWARP connection manager returns work items to a free list while the same

CVSS 9.8CVE-2026-45898Firmware, BMC & network fabriccurated

Impact

The iWARP connection manager returns work items to a free list while the same items are still queued on the workqueue, so they get re-initialised under the workqueue's feet. The result is workqueue list corruption and a kernel BUG - a hard panic that takes the whole shared node down and every tenant's job with it. Corrupting kernel list pointers is also a classic escalation primitive, and the CNA rates it network-reachable with no privileges.

Who can reach it

Driven by ordinary connection churn on the fabric: any tenant using rdma_cm, or a remote peer opening and closing iWARP connections quickly, hits it. The upstream reproducer is plain ucmatose stress on an Intel E830 in iWARP mode. Requires iw_cm in use - irdma in iWARP mode, cxgb4, or soft-iWARP siw. Not reachable on pure RoCE/IB paths.

What to do

Update to a stable kernel carrying 38c5b49fffa1 (or eb715133e0ae / a6b9e793e74e) and reboot. Interim: run irdma in RoCE rather than iWARP mode where the fabric allows it, and unload/blacklist siw on nodes that do not need soft-iWARP.

References

https://git.kernel.org/stable/c/38c5b49fffa1b760959af74f11806eeb3ef4706d https://git.kernel.org/stable/c/eb715133e0ae12514bba4d2d5ce1dee774476056 https://nvd.nist.gov/vuln/detail/CVE-2026-45898

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.