Linux kernel RDMA/core: iWARP port mapper initialises its refcount after publishing the request

Impact

iwpm_get_nlmsg_request() adds the new nlmsg_request to the global list before initialising its kref and its other fields. Another CPU can find it on that list and kref_get() a refcount that is still zero, which is the classic "addition on 0" pattern that leads to a premature free and then a use-after-free of the request object in kernel memory. This lives in the RDMA core used by iWARP-capable fabric adapters, and on a GPU cluster the RDMA stack is the data path that crosses tenants, so kernel memory corruption there is worth patching even though the window is a race. The record is a stable-tree fix with no CVSS score and no proof-of-concept; it does not establish whether the race is winnable from an unprivileged context.

Who can reach it

Local: the path is driven by the iWARP port mapper netlink exchange, which in practice means the iwpmd daemon or another process able to send RDMA netlink messages - typically privileged. It is a race between CPUs, not a remotely reachable interface. Nodes with no iWARP-capable adapter and no port mapper in use are not exercising this code.

What to do

Take the stable kernel update that initialises the kref and the remaining fields before list_add_tail(), then drain and reboot each node, or at minimum reload the RDMA core and provider modules - which on a GPU node means tearing down every RDMA-using workload first, so a drain and reboot is usually the cheaper window. Clusters that do not run iWARP can defer to their normal kernel cadence. The record names only the stable commits, not a fixed release version.

References

Related entries

• Linux kernel perf: NULL pmu dereference when a PMU module unloads with an event openCVE-2026-98268 · Linux kernel perf (is_include_guest_event / mediated PMU accounting)Unscored
• Linux kernel x86/kprobes: wrong return address when probing a CS-prefixed CALL crashes the hostCVE-2026-98273 · Linux kernel x86/kprobes (int3_emulate_call instruction length)Unscored
• powerpc/iommu: TCE IOBA range check ignores npages, allowing out-of-range table accessCVE-2026-98282 · Linux kernel powerpc/iommu (iommu_tce_check_ioba npages validation)Unscored
• KVM PPC Book3S HV: use-after-free on nested guest struct during all-LPID tlbie emulationCVE-2026-98283 · Linux kernel KVM PPC Book3S HV (kvmhv_emulate_tlbie_all_lpid)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical