CVE-2026-93110: RDMA/core: Wait for RCU callbacks before unloading ib_core
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Wait for RCU callbacks before unloading ibcore
putgidndev() is queued with callrcu() and implemented in ibcore. Stopping the workqueues does not drain callbacks already queued, so RCU could invoke it after the module code has been unloaded.
synchronizercu() does not wait for callbacks. Wait for them after all producers have stopped.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel systems using the RDMA core module (ib_core) when the module can be unloaded while RCU callbacks associated with put_gid_ndev() remain queued.
What condition triggers the unsafe unload?
put_gid_ndev() queues its work through call_rcu(), and stopping workqueues does not drain callbacks that were already queued. If ib_core is unloaded before those callbacks run, RCU can later invoke code from the unloaded module.
What does the resolved change do?
The fix waits for queued RCU callbacks after all callback producers have stopped and before ib_core is unloaded. This prevents callbacks from executing after the module code is gone.