Database/Kernel, userspace & hypervisor
Linux kernel RDMA/uverbs: REG_MR ioctl passes NULL udata, crashing mthca, irdma and siw
Impact
The commit that added the REG_MR ioctl method missed that three providers - mthca, irdma and siw - carry driver-specific UHW data with reg_mr and assume udata is never NULL. Registering a memory region through the ioctl path with no valid udata therefore dereferences NULL inside those drivers and panics the host. rdma-core's ibv_cmd_reg_mr_ex() never passes udata and those drivers do not use it, so this never fires in normal operation - it takes a userspace process deliberately issuing the raw ioctl. Relevant where the RDMA path is irdma (Intel E810 RoCE) or siw (software iWARP, common in test and mixed-fabric clusters) and tenant workloads hold the verbs devices; the outcome is a node panic that drops every co-tenant, not memory disclosure.
Who can reach it
Local user holding an open /dev/infiniband/uverbs* device on a node whose RDMA provider is mthca, irdma or siw, issuing a crafted REG_MR ioctl. Requires deliberate action - no stock library or application triggers it.
What to do
Update the host kernel to a stable release adding UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR (three stable commits linked) and reboot the node. Nodes whose fabric is mlx5/ConnectX are not affected by the NULL-udata crash described here. Until patched, restrict uverbs device access on irdma and siw nodes. No fixed release number is stated.
References
Related entries
- Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
- Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical
- VMware ESXi (OpenSLP): Use-after-free in OpenSLP on port 427 - unauthenticated remote code execution on the hypervisorCVE-2020-3992 · VMware ESXi (OpenSLP)Critical
- Linux kernel mlx5_core kTLS RX offload: TLS RX resync list corruption: entries are moved by the resync handlerCVE-2021-47215 · Linux kernel mlx5_core kTLS RX offloadCritical
- Linux kernel (drivers/nvme/host): The NVMe/RDMA initiator destroys the queue pair before the connection manager ID, soCVE-2021-47378 · Linux kernel (drivers/nvme/host)Critical
- Linux kernel (net/tls): KTLS stored a negative errno into the socket error field where a positive value is expected. ACVE-2021-47496 · Linux kernel (net/tls)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.