Linux kernel RDMA/cxgb4: use-after-free if device removal races the deferred RDMA registration work

Impact

c4iw_uld_state_change() queues reg_work to register the iWARP device, and c4iw_remove() can free ctx->dev while that work is still pending or running, leaving c4iw_register_device() touching freed memory. The practical exposure is small and worth stating plainly: it only fires on Chelsio T4/T5 adapters, only during driver teardown or PCI hotplug, and only root can drive that - there is no tenant-reachable path here. The consequence if it does fire is host memory corruption during a maintenance action on a node, which is the worst time to discover it. Found by an in-house static analysis tool, with no evidence of exploitation in the record.

Who can reach it

Local root, or an automated process that unloads or hot-removes the cxgb4 device, on a host with Chelsio iWARP hardware. Not reachable by unprivileged users or tenants.

What to do

Pick up the stable kernel update that cancels reg_work before device removal (four stable commits linked) and reboot the node; the change can be deferred to the next routine kernel maintenance window given the root-only trigger. Until then, avoid unloading or hot-removing cxgb4 on production nodes. The record names no fixed release numbers.

References

Related entries

• Linux kernel ACPI Platform Firmware Runtime Update: firmware-supplied length overflows a stack bufferCVE-2026-89587 · Linux kernel ACPI pfr_update (query_capability _DSM buffer copy)Unscored
• Linux kernel APEI GHES: wrong sizeof lets ARM error-record parsing read past the CPER sectionCVE-2026-89588 · Linux kernel ACPI APEI GHES (ARM processor CPER section length accounting)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored