CVE-2026-89509: RDMA/ionic: Embed counter driver data in rdma_counter allocation
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ionic: Embed counter driver data in rdmacounter allocation
Commit 7e53b31acc7f ("RDMA/core: Create and destroy rdmacounter using rdmazallocdrvobj()") requires drivers implementing counter ops to embed struct rdmacounter in a driver-specific struct, register its size via INITRDMAOBJSIZE, and provide a counterinit callback.
The ionic driver was merged without this adaptation, causing a NULL pointer dereference in allocandbind() since rdmazallocdrvobj() allocates zero bytes when sizerdmacounter is unset.
Consolidate struct ioniccounter into a new struct ionicrdmacounter that embeds struct rdmacounter, replace the xarray with a lightweight ida for ID allocation, and add the required counterinit and INITRDMAOBJSIZE declarations.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's RDMA ionic driver are exposed when that driver implements counter operations without the required embedded rdma_counter allocation setup. The issue is tied to the ionic driver's counter allocation path.
What action triggers the failure?
The failure occurs in alloc_and_bind() when a counter is allocated and bound. Because the driver has not registered the rdma_counter object size, rdma_zalloc_drv_obj() allocates zero bytes and a NULL pointer dereference results.
How can I determine whether a kernel includes the fix?
Check whether the ionic RDMA driver defines a driver-specific structure embedding struct rdma_counter, registers its size with INIT_RDMA_OBJ_SIZE, and provides a counter_init callback. The corrected implementation also replaces the previous counter xarray with an ida for ID allocation.