Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rn_unregister on failed accept When svc_rdma_accept() takes the errout path before rpcrdma_rn_register() has succeeded, the existing cleanup block calls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally. svcxprt_rdma is kzalloc'd, so on that path sc_rn.rn_index is 0 and sc_rn.rn_done is NULL; the unregister therefore xa_erase()s another caller's slot 0 and performs an unmatched kref_put() on the rpcrdma_device's rd_kref. The same errout also brackets the cleanup with svc_xprt_get()/ svc_xprt_put() around the kref_init() birth reference. The kref goes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the net/ns_tracker it pinned) is leaked on every failed accept. rpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc() and kref_get() have both succeeded, so rn_done == NULL is a natural "never registered" sentinel. Guard rpcrdma_rn_unregister() with an early return when rn_done is NULL, and clear rn_done before the matching xa_erase() so a repeated unregister is also a no-op. With that guard in place, the accept errout drops the kref_init() birth reference via svc_xprt_put(), which dispatches svc_rdma_free(). Teardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing IS_ERR/NULL guards in svc_rdma_free(); sc_rn is covered by the new rn_done sentinel; sc_cm_id is non-NULL on every errout path because svc_rdma_accept() dereferences it above the first goto errout. svc_xprt_free() drops the module reference associated with the freed transport, and svc_handle_xprt() drops its pre-acquired reference when ->xpo_accept() returns NULL. Take a replacement module reference before svc_xprt_put() so the two module_put()s remain balanced. The rn_done guard also covers svc_rdma_free()'s non-listener call to rpcrdma_rn_unregister() for transports whose register attempt failed or never ran.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-24T16:17:17.720Z",
  "pubdate": "2026-09-24T16:17:17.720Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel's svcrdma component related to improper error handling during connection acceptance.\nThe flaw manifests as an incorrect cleanup procedure in svc_rdma_accept() when registration fails, leading to uninitialized resource deregistration and memory leakage.\nSpecifically, the vulnerability results in an unauthorized xa_erase() operation on XArray slot 0 and a mismatched kref_put() call, both of which compromise system stability.\nFurthermore, the improper lifecycle management of the svcxprt_rdma structure results in a kernel memory leak during every failed accept attempt, potentially leading to exhaustion of kernel memory and network namespace tracking structures.\nWhile this vulnerability primarily impacts system availability and integrity, a local or remote attacker capable of triggering frequent RDMA connection failures could escalate this into a Denial of Service (DoS) condition.\nExploitation requires no specific authentication beyond the ability to initiate RDMA connection requests to the target system.",
  "technicalDetails": "The root cause of the vulnerability is the unconditional invocation of rpcrdma_rn_unregister() within the error path of svc_rdma_accept() before the rpcrdma_rn_register() process has successfully completed.\nBecause the svcxprt_rdma structure is allocated via kzalloc, the sc_rn.rn_done field is initialized to NULL. The current implementation lacks a sentinel check for this state, causing the cleanup logic to erroneously perform an xa_erase() on index 0 of the XArray, which typically belongs to another legitimate transport object. This effectively corrupts the state of other connections.\nSimultaneously, the mismatched rpcrdma_rn_unregister() call performs an unwarranted kref_put() on the rpcrdma_device's rd_kref, prematurely decrementing the reference count.\nThe error path also mismanages the lifecycle of the transport object itself. By wrapping the cleanup in svc_xprt_get() and svc_xprt_put() without appropriately balancing the initial kref_init() birth reference, the svcxprt_rdma object and its associated net/ns_tracker are never released. This leads to persistent kernel memory leaks.\nStep-by-step exploitation flow: 1) An attacker initiates an RDMA connection request to the server. 2) The server proceeds to svc_rdma_accept(). 3) The process encounters an error condition before successful registration via rpcrdma_rn_register(). 4) The kernel jumps to the 'errout' label. 5) The faulty cleanup logic executes rpcrdma_rn_unregister() using a NULL-initialized 'rn_done' field. 6) The XArray entry at index 0 is corrupted, and the rd_kref is erroneously decremented. 7) The transport object is leaked due to improper reference counting, causing a gradual increase in memory consumption.\nThe resolution involves implementing a guard within rpcrdma_rn_unregister() to verify the status of rn_done. By treating rn_done == NULL as a 'never registered' sentinel, the function can safely exit before affecting the XArray or kref. Additionally, the cleanup path must be refactored to ensure the module reference associated with the transport is correctly balanced via a replacement module_get() call before the final svc_xprt_put()."
}