CVE-2026-80625: RDMA/hns: Fix memory leak of bonding resources
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix memory leak of bonding resources
In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hnsrocehwv2exit() during driver removal, and then is allocated again in hnsroceregisterdevice() during driver reset. This leads to memory leak because the release timing has already passed. This may also lead to a kernel panic as below because of the leaked notifier callback:
Call trace: 0xffffa20fccc04978 (P) rawnotifiercallchain+0x20/0x38 callnetdevicenotifiersinfo+0x60/0xb8 netdevlowerstatechanged+0x4c/0xb8
As Sashiko suggested, the teardown order of bonding resources should be inverted to make sure the resources are released when the driver is removed.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel RDMA/hns driver with bonding resources are exposed in the described corner case. The issue requires concurrent driver removal and driver reset.
What operational impact can occur if the issue is triggered?
Bonding resources can be reallocated after their release timing has passed, causing a memory leak. A leaked notifier callback may also cause a kernel panic during network-device notifier processing.
How can administrators recognize a possible occurrence?
A kernel panic with a call trace involving raw_notifier_call_chain, call_netdevice_notifiers_info, and netdev_lower_state_changed is identified as a possible symptom. The relevant triggering condition is overlap between driver removal and driver reset.
What is the remediation described for this issue?
The fix inverts the teardown order for bonding resources so they are released when the driver is removed. The provided stable kernel references identify the patches containing this change.