Linux kernel (drivers/infiniband/core): Because re-registration can swap the protection domain behind a memory region

Impact

Because re-registration can swap the protection domain behind a memory region, every place the resource-tracking netlink interface reached through mr->pd was racing. A tenant that re-registers an MR while the operator's tooling walks RDMA resources makes the host dereference a stale PD pointer - kernel memory corruption triggered from inside a container against host-context code.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* calls ibv_rereg_mr in a loop; the racing reader is the host side running rdma resource show mr or any monitoring agent that polls nldev. Both halves are routine, so an operator with RDMA telemetry collection is exposed continuously rather than only under attack.

What to do

Update to a stable kernel carrying 1a132ee4e655 (or 50d5c02ab8e6) and reboot. Interim: stop polling nldev MR resources from monitoring agents on nodes running untrusted tenants until patched.

References