Linux kernel RDMA/counter: failed QP bind leaks the port counter count and wedges counter mode

Impact

When __rdma_counter_bind_qp() fails, alloc_and_bind() frees the counter without decrementing port_counter->num_counters, and the only code that decrements it is unreachable for a counter that was never bound. Each failure therefore permanently inflates the count, and once inflated the port can no longer be switched to AUTO mode (__counter_set_mode() returns -EBUSY) and the MANUAL-to-NONE auto-revert never happens. For an InfiniBand or RoCE fabric this breaks per-QP statistics on the affected port - the telemetry operators use to find a bad link or a noisy tenant across a GPU training fabric - and the state does not recover without a reboot. No memory corruption, no data disclosure; the damage is to fabric observability and it requires the privilege to manage RDMA counters in the first place.

Who can reach it

Local, privileged: a user or agent able to bind RDMA per-QP counters through the RDMA netlink/configfs interface, typically root on the node or a fabric management daemon. Not reachable from an unprivileged tenant pod.

What to do

Take the stable kernel fix (adds an err_bind label that decrements num_counters and mirrors the MANUAL-to-NONE revert) and reboot the node on the normal kernel-update cadence. The leaked count cannot be reset at runtime, so a node already in this state needs a reboot regardless of the patch.

References

Related entries

• Linux kernel hfi1: PIO credit-return mmap installs a bad pfn and oopses the nodeCVE-2026-98216 · Linux kernel IB/hfi1 (PIO_CRED credit-return mmap)Unscored
• Linux kernel RDMA/ucma: race between concurrent multicast join and leave frees in-use stateCVE-2026-98253 · Linux kernel RDMA/ucma (multicast join/leave serialization)Unscored
• Linux kernel RDS/IB: protocol version mismatch deadlocks the RDS connection workqueuesCVE-2026-98257 · Linux kernel RDS over InfiniBand (rds_ib_cm_connect_complete)Unscored
• Linux kernel RDMA/siw: out-of-bounds write from fragmented DDP/RDMAP header copiesCVE-2026-98323 · Linux kernel RDMA/siw (software iWARP DDP/RDMAP header parsing)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored