Linux kernel hns_roce: bonding teardown order leaks resources and leaves a stale netdev notifier

Impact

When driver removal and a driver reset race, hns_roce releases its bonding resources in hns_roce_hw_v2_exit() and then reallocates them in hns_roce_register_device(), past the point where they can ever be freed. Besides the memory leak, the leaked netdev notifier callback stays registered and is invoked later from netdev_lower_state_changed(), which the report shows ending in a kernel panic. On a fleet using HiSilicon RoCE NICs for the storage or east-west fabric, that panic lands during exactly the events operators trigger deliberately - a driver reset after a link fault, or an unbind during maintenance - so a routine fabric recovery can drop the node instead of healing it. The record gives no indication that an unprivileged user can drive this; it is a race between administrative and error-recovery paths.

Who can reach it

Not reachable by an unprivileged tenant per the record. It requires driver removal (root, or a package upgrade unbinding the module) to run concurrently with a driver reset, which the hardware or error recovery can raise on its own. Only nodes with HiSilicon hns RoCE devices are affected.

What to do

Update to a kernel with the corrected teardown ordering and reboot the affected nodes; a module reload is not a safe substitute here because the bug is in the unbind path itself. Until then, avoid unbinding or upgrading the hns_roce driver while the fabric is flapping, and schedule module changes when the link is stable. The record lists two stable commits and no vendor-fixed version.

References

Related entries

• Linux kernel Soft-RoCE: modify_qp frees the rd_atomic array using the new size, writing out of boundsCVE-2026-80863 · Linux kernel RDMA/rxe (free_rd_atomic_resources during modify_qp)Unscored
• Linux kernel rdma_rxe: use-after-free in the responder task when modify_qp swaps the RD-atomic resource arrayCVE-2026-80864 · Linux kernel Soft-RoCE responder (rdma_rxe, IB_QP_MAX_DEST_RD_ATOMIC modify_qp)Unscored
• Linux kernel mlx5_ib: implicit ODP parent mkey re-registered in place, racing its child mkeys and mr->pdCVE-2026-80880 · Linux kernel mlx5_ib implicit ODP (rereg_mr on a parent mkey)Unscored
• Linux tpm_i2c_nuvoton: unbalanced enable_irq() on wait timeout can wedge TPM accessCVE-2026-80930 · Linux kernel tpm_i2c_nuvoton (TPM I2C driver IRQ balance)Unscored
• Linux kernel ipmi_msghandler: work item left scheduled when interface startup fails, freeing live stateCVE-2026-81004 · Linux kernel IPMI message handler (ipmi_msghandler interface startup error path)Unscored
• Linux kernel ipmi_si: NULL pointer dereference after a failed IPMI interface registrationCVE-2026-81005 · Linux kernel ipmi_si / ipmi_msghandler (failed BMC registration path)Unscored