Linux kernel RDMA/ionic: NULL dereference allocating an RDMA counter on AMD Pensando DPUs

Impact

The ionic RDMA driver was merged without the counter-object adaptation that RDMA core now requires: it never registers size_rdma_counter or a counter_init callback, so rdma_zalloc_drv_obj() allocates zero bytes and alloc_and_bind() dereferences NULL. Anyone who configures per-QP statistics counters on an ionic device takes the host kernel down, which on a GPU node means an unplanned loss of every job on it. Exposure is narrow: it only affects fleets running AMD Pensando DPUs with the ionic RDMA driver, and driving the counter path normally takes privileges on the RDMA netlink interface rather than tenant-level access. Treat it as an availability bug in a specific NIC driver, not a tenant escape.

Who can reach it

Local administrator or process able to create and bind RDMA counters through RDMA netlink (the rdma statistic tooling) on a host with an ionic RDMA device. Not reachable on nodes without that hardware.

What to do

Update to a kernel containing the fix (three stable commits linked; it consolidates the counter struct and adds the required declarations) and reboot the affected nodes. Until then, avoid configuring per-QP RDMA counters on ionic devices. No fixed release numbers are stated in the record.

References

Related entries

• Linux kernel RDMA/cxgb4: use-after-free if device removal races the deferred RDMA registration workCVE-2026-89510 · Linux kernel RDMA/cxgb4 (c4iw_remove vs pending reg_work)Unscored
• Linux kernel ACPI Platform Firmware Runtime Update: firmware-supplied length overflows a stack bufferCVE-2026-89587 · Linux kernel ACPI pfr_update (query_capability _DSM buffer copy)Unscored
• Linux kernel APEI GHES: wrong sizeof lets ARM error-record parsing read past the CPER sectionCVE-2026-89588 · Linux kernel ACPI APEI GHES (ARM processor CPER section length accounting)Unscored
• Linux kernel RDMA/counter: failed QP bind leaks the port counter count and wedges counter modeCVE-2026-97477 · Linux kernel RDMA/counter (num_counters leak in alloc_and_bind() error path)Unscored
• Linux kernel hfi1: PIO credit-return mmap installs a bad pfn and oopses the nodeCVE-2026-98216 · Linux kernel IB/hfi1 (PIO_CRED credit-return mmap)Unscored
• Linux kernel RDMA/ucma: race between concurrent multicast join and leave frees in-use stateCVE-2026-98253 · Linux kernel RDMA/ucma (multicast join/leave serialization)Unscored