Linux kernel mlx4 InfiniBand driver: SRQ leaked on create failure, exhausting fabric resources

Impact

mlx4_ib_create_srq() allocated a shared receive queue through mlx4_srq_alloc() and, on a later error, returned without calling mlx4_srq_free(). Every failed SRQ creation permanently burns a hardware SRQ slot on the ConnectX-3 adapter. A local user holding an RDMA device - which on a GPU cluster means any tenant whose pod gets the verbs device for NCCL or MPI - can repeat the failing call to drain the adapter's SRQ table, after which RDMA queue-pair setup fails for everyone on that host. That turns a leak into a fabric-level denial of service on a shared node: collectives stop forming and the node has to be rebooted to recover the adapter state. NVD rates it 7.8 local; the leak itself is the established effect, nothing in the record points to memory disclosure or code execution.

Who can reach it

Local, authenticated. A user or container with access to an mlx4 RDMA device node (/dev/infiniband/uverbsN) who can make SRQ creation fail repeatedly. Not reachable from the network, and not reachable at all on hosts with no ConnectX-3 class adapter.

What to do

Update to a fixed stable kernel and reboot the affected hosts. mlx4 covers ConnectX-3 and ConnectX-3 Pro only, so inventory first - modern ConnectX-5/6/7 fleets run mlx5 and are not affected. For nodes that are affected, the practical interim control is to stop handing raw verbs devices to untrusted tenants.

References

Related entries

• Linux kernel RDMA core (ib_umem / IB_MR_REREG_ACCESS re-registration): An RDMA memory region registered read-only canCVE-2026-52908 · Linux kernel RDMA core (ib_umem / IB_MR_REREG_ACCESS re-registration)High
• Linux kernel RDS over InfiniBand (use outside the initial network namespace): The RDS/IB transport was never written toCVE-2026-53077 · Linux kernel RDS over InfiniBand (use outside the initial network namespace)High
• Linux kernel (drivers/infiniband/core): When the IOMMU coalesces a large memory registration into one block spanningCVE-2026-53133 · Linux kernel (drivers/infiniband/core)High
• Linux kernel crypto/qat: unused qat_adf_ctl character device and IOCTLs removed as attack surfaceCVE-2026-64529 · Linux kernel QAT driver character device (qat_adf_ctl IOCTLs)High
• Linux kernel Soft-RoCE mmap path (rdma_rxe, rxe_mmap vs concurrent DESTROY_CQ): Rxe_mmap() removes the mmap-info objectCVE-2026-64582 · Linux kernel Soft-RoCE mmap path (rdma_rxe, rxe_mmap vs concurrent DESTROY_CQ)High
• Linux kernel (drivers/infiniband/sw/siw): Soft-iWARP published a new queue pair into the lookup table before itsCVE-2026-68417 · Linux kernel (drivers/infiniband/sw/siw)High