Linux kernel RDMA/erdma: failed destroy commands leak QPs, MRs, doorbells and resource identifiers

Impact

erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr() and erdma_destroy_ah() returned early whenever the hardware command failed, leaking queue buffers, MTTs, doorbell pages and the STAG, QPN, CQN and AHN identifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and permanently disables the command queue, so retries cannot succeed, and forced uverbs cleanup then nulls the pointers - the resources are unreachable for the lifetime of the boot. For a fleet using elastic RDMA, repeated teardown failures exhaust identifier space and pinned memory until the node is rebooted, which is the expensive case on a GPU node carrying long training jobs. This affects the erdma driver specifically (Alibaba Cloud elastic RDMA), not mlx5 or the generic RDMA core.

Who can reach it

Local user or container holding RDMA verbs access (/dev/infiniband/uverbs*) on a node using the erdma driver, in a state where the device command queue is failing or timing out. Authenticated node access required; no network path.

What to do

Apply the stable kernel commits in the record, which warn on failure but release every software-owned resource. Rollout is a distribution kernel update, so drain and reboot each erdma-equipped node. Nodes that have already leaked resources need a reboot regardless, since the command queue stays disabled once it has timed out.

References

Related entries

• Linux kernel RDMA core: port speed query can call ethtool on an unregistering netdevCVE-2026-98359 · Linux kernel RDMA core (ib_get_eth_speed netdev registration check)High
• Linux kernel RDMA/rxe: use-after-free on multicast group when rxe_mcast_add() failsCVE-2026-98360 · Linux kernel RDMA/rxe (soft-RoCE multicast group publication)High
• Linux net/rds: use-after-free of the RDMA CM id when rdma_resolve_route() fails synchronouslyCVE-2026-99212 · Linux kernel net/rds (RDMA connection manager id ownership on route-resolve failure)High
• GRUB2 (USB device initialization): Out-of-bounds write in grub_usb_device_initialize from a malicious USB descriptorCVE-2020-25647 · GRUB2 (USB device initialization)Medium
• AMD Secure Processor PCI driver - input validation: Improper input validation in the ASP PCI driver lets a localCVE-2025-0045 · AMD Secure Processor PCI driver - input validationMedium
• AMD SEV firmware - RMP write during SNP initialization: A privileged attacker can write to the reverse map page duringCVE-2025-29939 · AMD SEV firmware - RMP write during SNP initializationMedium