Linux kernel RDMA/ucma: race between concurrent multicast join and leave frees in-use state

Impact

Two concurrent JOIN_MCAST ioctls on the same address through /dev/infiniband/rdma_cm can insert a second CMA multicast entry before the first thread's leave-by-address runs, so leave cancels the wrong work and an older RoCE worker dereferences a ucma_multicast the first thread already freed. The result is a use-after-free reachable from an unprivileged process that holds the rdma_cm character device - on GPU nodes that is any tenant permitted to use RoCE or RDMA verbs from a pod. Consequence is a kernel crash, and potentially corruption of adjacent kernel state, on a node that is carrying fabric traffic for other tenants.

Who can reach it

Local user or container with access to /dev/infiniband/rdma_cm (typical where RDMA/RoCE is exposed to tenant pods). No network authentication needed; no remote path.

What to do

Take the stable-tree fix that holds ctx->mutex from rdma_join_multicast() through copy_to_user() and through the -EFAULT leave path. Shipping it means a kernel update and a reboot of each affected node, so drain GPU workloads first. Until then, restrict /dev/infiniband/rdma_cm exposure to tenant containers. No vendor advisory or CVSS score is published in the record.

References

Related entries

• Linux kernel RDS/IB: protocol version mismatch deadlocks the RDS connection workqueuesCVE-2026-98257 · Linux kernel RDS over InfiniBand (rds_ib_cm_connect_complete)Unscored
• Linux kernel RDMA/siw: out-of-bounds write from fragmented DDP/RDMAP header copiesCVE-2026-98323 · Linux kernel RDMA/siw (software iWARP DDP/RDMAP header parsing)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored