CVE-2026-72468: xprtrdma: Initialize re_id before removal registration
In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: Initialize reid before removal registration
rpcrdmacreateid() registers ep->rern with the rpcrdma ibclient before returning the new rdmacmid to rpcrdmaepcreate(). However rpcrdmaepcreate() currently stores that pointer in ep->reid only after rpcrdmacreateid() returns.
A local administrator can race an NFS/RDMA mount against RDMA device removal. If rpcrdmaremoveone() observes the just-registered notification before rpcrdmaepcreate() assigns ep->reid, rpcrdmaepremovaldone() calls tracexprtrdmadeviceremoval(NULL). The tracepoint dereferences id->device->name and copies id->route.addr.dstaddr, so the callback can crash the kernel with a NULL pointer dereference.
Store the rdmacmid in ep->reid immediately before publishing ep->rern. The existing error path still destroys the id directly if registration fails; ep is then freed by the caller without using ep->reid. Remove the later duplicate assignment in rpcrdmaepcreate().
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the code changes described in the resolution: (1) remove the later duplicate assignment in rpcrdma_ep_create(); (2) store the rdma_cm_id in ep->re_id immediately before publishing; (3) ensure re_id is initialized before removal registration (rpcrdma_ep_removal_done() uses trace_xprtrdma_device_removal(NULL)).
Linux kernel (xprtrdma/rpcrdma) rpcrdma_ep_create()/removal initialization = Store the rdma_cm_id in ep->re_id immediately before publishing; remove later duplicate assignment in rpcrdma_ep_create(); initialize re_id before removal registration