CVE-2026-31425

Vulnerability

Overview

CVE-2026-31425 is a null-pointer dereference vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) InfiniBand (IB) driver. The root cause lies in the rds_ib_get_mr() function, which extracts an rds_ib_connection object from the connection's transport data and passes it to rds_ib_reg_frmr() for Fast Memory Registration (FRWR). On a fresh outgoing connection, the ic structure is allocated early in rds_ib_conn_alloc(), but the i_cm_id field is set to NULL because the connection worker has not yet invoked rds_ib_conn_path_connect() to create the rdma_cm_id. When a user calls sendmsg() with the RDS_CMSG_RDMA_MAP control message before connection establishment, the sendmsg path parses the control message, eventually leading rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp, which crashes the kernel [1].

Exploitation

The attack vector is local, requiring no special privileges beyond the ability to use RDS sockets and the RDS_CMSG_RDMA_MAP control message. An attacker must create an RDS socket, initiate an outgoing connection, and immediately send a message with an RDMA map request before the connection is fully established. The existing guard in rds_ib_reg_frmr() only checks for a NULL ic pointer, which is insufficient because ic is always non-NULL once the connection object exists. The check does not verify that i_cm_id or qp are valid, allowing the null-pointer dereference to occur [1].

Impact

Successful exploitation results in a kernel panic (null-ptr-deref), leading to a denial of service (DoS) on the affected system. The crash signature, as shown in the kernel fault report, occurs in rds_ib_post_reg_frmr() at line 167 of ib_frmr.c. Local users with access to RDS sockets can trigger this condition, causing system instability or complete system crash [1].

Mitigation

Patches have been committed to the Linux kernel stable trees. The fix adds a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all non-NULL before proceeding with FRMR registration, mirroring an existing guard in rds_ib_post_inv(). If the connection is not ready, the function now returns -ENODEV, which the existing error handling in rds_cmsg_send() converts to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to start the connection worker [1]. Affected users should apply the kernel update containing the commit 23e07c340c445 (or its backports) as soon as possible.