Linux kernel RDMA core: port speed query can call ethtool on an unregistering netdev

Impact

ib_get_eth_speed() took a reference on the backing net_device and then invoked its ethtool callback without checking the registration state, so an asynchronous RDMA port query could run against a netdev after NETDEV_UNREGISTER and ndo_uninit had already completed. The record rates it local, low-privilege, high complexity, with confidentiality, integrity and availability impact - in practice a use-after-teardown window hit by racing a port query against RoCE interface removal. On a GPU node this is the RoCE/InfiniBand path that carries NCCL traffic, so the blast radius is a kernel fault on a node that is in the middle of fabric reconfiguration rather than a tenant-crossing read. The race needs an unregister to be in flight, which is an operator action (driver unload, interface teardown, SR-IOV VF removal), not something a tenant can trigger on demand.

Who can reach it

Local user able to issue RDMA port queries (an ioctl/sysfs query on an ib device, no special privilege beyond device access) racing a netdev unregister. Not reachable from the network.

What to do

Pick up the stable kernel commits listed in the record (the fix checks NETREG_REGISTERED under RTNL and returns -ENODEV) and reboot each node once the patched kernel is installed. There is no runtime mitigation; until then, avoid tearing down RoCE interfaces while RDMA clients are active. Rolling this out means draining and rebooting every GPU node, so most operators will fold it into the next scheduled kernel window rather than open one for this alone.

References

Related entries

• Linux kernel RDMA/rxe: use-after-free on multicast group when rxe_mcast_add() failsCVE-2026-98360 · Linux kernel RDMA/rxe (soft-RoCE multicast group publication)High
• GRUB2 (USB device initialization): Out-of-bounds write in grub_usb_device_initialize from a malicious USB descriptorCVE-2020-25647 · GRUB2 (USB device initialization)Medium
• AMD Secure Processor PCI driver - input validation: Improper input validation in the ASP PCI driver lets a localCVE-2025-0045 · AMD Secure Processor PCI driver - input validationMedium
• AMD SEV firmware - RMP write during SNP initialization: A privileged attacker can write to the reverse map page duringCVE-2025-29939 · AMD SEV firmware - RMP write during SNP initializationMedium
• AMD Secure Processor PCI driver - use-after-free: A use-after-free reachable through the ASP PCI driverCVE-2025-48521 · AMD Secure Processor PCI driver - use-after-freeMedium
• IBM Power Systems FSP: authenticated admin can force a persistent degraded operating modeCVE-2026-16938 · IBM Power Systems Firmware (FSP privileged system configuration controls)Medium