CVE-2026-93103: RDMA/hfi1: Preserve unit 0 on allocation failure
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Preserve unit 0 on allocation failure
hfi1freedevdata() assumes that the device was inserted into the unit table and unconditionally erases dd->unit. If xaallocirq() fails, the zero-initialized unit remains zero, so full cleanup can remove an unrelated device from index 0.
Release only the rdmavt allocation and return immediately while the unit table has not acquired the device.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel RDMA/hfi1 driver are exposed when device initialization reaches the xa_alloc_irq() failure path. The issue concerns cleanup of hfi1 device data before the device has been added to the unit table.
What condition is required to trigger the erroneous removal?
xa_alloc_irq() must fail during hfi1 device setup. Because the unit field remains zero-initialized, subsequent full cleanup can erase unit-table index 0 even though it belongs to an unrelated device.
What is the impact if the failure path is reached?
An unrelated hfi1 device at unit-table index 0 can be removed during cleanup. The resolved behavior releases only the rdmavt allocation and returns before unit-table cleanup occurs.