CVE-2026-45910: RDMA/rxe: Fix race condition in QP timer handlers
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix race condition in QP timer handlers
I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxetask.c:249 at rxeschedtask+0x1c8/0x238 [rdmarxe], CPU#0: swapper/0/0 ... libsha1 [last unloaded: ip6udptunnel] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G C 6.19.0-rc5-64k-v8+ #37 PREEMPT Tainted: [C]=CRAP Hardware name: Raspberry Pi 4 Model B Rev 1.2 Call trace: rxeschedtask+0x1c8/0x238 [rdmarxe] (P) retransmittimer+0x130/0x188 [rdmarxe] calltimerfn+0x68/0x4d0 runtimers+0x630/0x888 ... WARNING: drivers/infiniband/sw/rxe/rxetask.c:38 at rxeschedtask+0x1c0/0x238 [rdmarxe], CPU#0: swapper/0/0 ... WARNING: drivers/infiniband/sw/rxe/rxetask.c:111 at dowork+0x488/0x5c8 [rdmarxe], CPU#3: kworker/u17:4/93400 ... refcountt: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcountwarnsaturate+0x138/0x1a0, CPU#3: kworker/u17:4/93400
The issue is caused by a race condition between retransmittimer() and rxedestroyqp, leading to the Queue Pair's (QP) reference count dropping to zero during timer handler execution.
It seems this warning is harmless because rxeqpdocleanup() will flush all pending timers and requests.
Example of flow causing the issue:
CPU0 CPU1 retransmittimer() { spinlockirqsave rxedestroyqp() rxecleanup() rxeput() // qp->refcount decrease to 0 rxeqpdocleanup() { if (qp->valid) { rxeschedtask() { WARNON(rxeread(task->qp) <= 0); } } spinunlockirqrestore } spinlockirqsave qp->valid = 0 spinunlockirqrestore }
Ensure the QP's reference count is maintained and its validity is checked within the timer callbacks by adding calls to rxeget(qp) and corresponding rxeput(qp) after use.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.63~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.71~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1062.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1063.69~22.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-136.136~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1060.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1058.61~22.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1057.58~22.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-134.134~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1055.56~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-134.134 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1063.71 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69 - Upgrade
Upgrade
ubuntu/linux-azure-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1039.42 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1058.64 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1045.48 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1060.61 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-134.134.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1058.61 - Upgrade
Upgrade
ubuntu/linux-nvidia-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-1058.61.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1029.30 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1057.58 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.8.0-1060.64 - Upgrade
Upgrade
ubuntu/linux-xilinxto a version that resolves this vulnerability.Fixed in 6.8.0-1032.33 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1026.30 - Upgrade
Upgrade
ubuntu/linux-raspi-realtimeto a version that resolves this vulnerability.Fixed in 6.8.0-2049.50 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1055.56 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1060.63+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1062.69+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-134.134+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1063.69+fips1 - Compensating control
In the RDMA/rxe QP timer callbacks, maintain the QP reference count and validate its state by adding rxe_get(qp) before use and a corresponding rxe_put(qp) after use, including in retransmit_timer().
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the RDMA RXE (rdma_rxe) software driver are exposed. The listed affected software includes Linux kernel packages for Ubuntu generic, riscv, realtime, Azure, GCP, Azure FDE, HWE edge, and GKE variants.
What conditions are involved in triggering the flaw?
The issue occurs when the RXE Queue Pair retransmission timer handler races with Queue Pair destruction. Exploitation requires local access and low privileges according to the supplied CVSS vector; no user interaction is required.
What is the potential impact?
The race can cause Queue Pair reference-count underflow and a use-after-free condition during timer-handler execution. The provided severity vector rates confidentiality, integrity, and availability impact as high.
How can I identify signs that a system may be affected?
Kernel warnings involving rdma_rxe task scheduling or work handling, retransmit_timer(), rxe_destroy_qp, refcount underflow, or use-after-free are relevant indicators. The reported traces include warnings in drivers/infiniband/sw/rxe/rxe_task.c and lib/refcount.c.
Are fixes available?
The vulnerability is described as resolved, and three stable kernel commit references are provided: 756c93d6df7c3bc599f6590b8e5afead6a41de1c, 3c2ae79fb19dfd67341c14f1e78a5f1744eacfe2, and 5ae9da022ee3c97e6469eabcddce9271501ddbad.