Linux kernel RDS/IB: protocol version mismatch deadlocks the RDS connection workqueues

Impact

When an RDS-over-IB peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION, the RDMA-CM event handler calls rds_conn_destroy() while holding c_cm_lock and then flushes shutdown work that needs the same lock. The two workers wait on each other and the RDS connection workqueues stall permanently. On a node using RDS over the InfiniBand/RoCE fabric this is a denial of service that does not clear itself: RDS connectivity is gone until the node is rebooted, and a node stuck this way has to be drained. The trigger is a peer-controlled protocol version on the fabric.

Who can reach it

Anyone able to initiate an RDS/IB connection to the node over the InfiniBand or RoCE fabric, including another tenant sharing that fabric. No authentication beyond fabric reachability. Only affects hosts with the RDS module loaded and in use.

What to do

Apply the stable fix that uses rds_conn_drop() instead of rds_conn_destroy() on the version-mismatch path - a kernel update and a node reboot, so drain the node first. If RDS is not used, blacklisting the rds and rds_rdma modules removes the exposure without a reboot of the workload. No vendor advisory or CVSS score in the record.

References

Related entries

• Linux kernel RDMA/siw: out-of-bounds write from fragmented DDP/RDMAP header copiesCVE-2026-98323 · Linux kernel RDMA/siw (software iWARP DDP/RDMAP header parsing)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored