Linux net/rds: use-after-free of the RDMA CM id when rdma_resolve_route() fails synchronously

Impact

rds_rdma_cm_event_handler_cmn() returns the rdma_resolve_route() error straight to the rdma_cm on ADDR_RESOLVED, which makes addr_handler() destroy the very id the event arrived on. Nothing clears ic->i_cm_id, so the RDS connection sits in CONNECTING holding a freed id until shutdown calls rdma_disconnect() and rdma_destroy_id() on it - a double free and use-after-free in the RDMA path. The triggers named are ordinary transient conditions on a fabric: an -ENOMEM allocating route work, an SA query that cannot be set up, or a RoCE route with no usable device, so a congested or partially misconfigured InfiniBand/RoCE fabric can reach it without an attacker. Affects only nodes that actually load and use RDS over RDMA; a GPU node doing RDMA with verbs or NCCL alone is not exposed.

Who can reach it

Local, requires RDS-over-RDMA in use on the node. Reached through connection setup failures on the IB/RoCE fabric rather than by an authenticated request; anyone able to make route resolution fail (fabric pressure, SA unavailability) can drive it.

What to do

Take the stable kernel that drops the connection and returns 0 so RDS keeps ownership of the id, then reboot the node. If RDS is not needed, blacklisting the rds_rdma/rds modules removes the exposure without a kernel change. No distribution fixed version appears in the record; only the kernel.org commits.

References

Related entries

• GRUB2 (USB device initialization): Out-of-bounds write in grub_usb_device_initialize from a malicious USB descriptorCVE-2020-25647 · GRUB2 (USB device initialization)Medium
• AMD Secure Processor PCI driver - input validation: Improper input validation in the ASP PCI driver lets a localCVE-2025-0045 · AMD Secure Processor PCI driver - input validationMedium
• AMD SEV firmware - RMP write during SNP initialization: A privileged attacker can write to the reverse map page duringCVE-2025-29939 · AMD SEV firmware - RMP write during SNP initializationMedium
• AMD Secure Processor PCI driver - use-after-free: A use-after-free reachable through the ASP PCI driverCVE-2025-48521 · AMD Secure Processor PCI driver - use-after-freeMedium
• Junos OS Evolved on PTX: packets rejected by an output filter are punted to the Routing EngineCVE-2025-59958 · Juniper Junos OS Evolved PFE on PTX Series (output firewall filter 'reject' terms)Medium
• Junos OS: FTP server lets a configured 'ftp' or 'anonymous' user log in without the passwordCVE-2025-59980 · Juniper Junos OS FTP server (anonymous/ftp account authentication)Medium