net: rds: fix uninitialized trans dereference in CM event handler
Summary
| CVE | CVE-2026-99166 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-28 11:17:37 UTC |
| Updated | 2026-10-30 13:21:50 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but the event switch dereferences it: unconditionally in the RDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(), and (with a connection context) in the ROUTE_RESOLVED and ESTABLISHED cases. An RDS listener on an iWARP device therefore crashes the kernel as soon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO the wild load becomes a NULL dereference at offset 0xa0 (&trans->cm_handle_connect) in the iw_cm_wq workqueue. GCC masks the bug in default builds by folding the uninitialized load into &rds_ib_transport; Clang-built kernels take the real uninitialized path and oops. The active side can land on a non-IB device too: the id that rds_ib_conn_path_connect() creates is not restricted to a node type, so rdma_resolve_addr() binds it to whichever device serves the local address, and an iWARP RNIC on the same netdev qualifies. The crash there is different: resolving a route on an iWARP id never fills in cm_id->route.path_rec, and the ROUTE_RESOLVED case writes path_rec[0].sl before it calls into the transport. The iWARP transport was dropped long ago and IB is the only transport left, so make that explicit: initialize trans to &rds_ib_transport at declaration, drop the conditional assignment, reject a connect request that arrives on a non-IB device, and drop a connection whose address resolved to one instead of resolving a route on it. The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUEST on purpose: a non-zero return from the handler makes rdma_cm destroy the id the event was delivered on, which is right for the request's freshly created id but would free a connection id that RDS still owns for any other event. On the active side the id stays ic->i_cm_id and the connection's shutdown destroys it, so that case returns 0. [achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of bailing out for every event on a non-IB device, so that rdma_cm does not destroy connection ids RDS still tracks; drop a connection whose address resolved to a non-IB device before a route is resolved on it; changelog adjusted] |
Risk And Classification
EPSS: 0.001720000 probability, percentile 0.066390000 (date 2026-10-30)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected dcdede0406d30e14a6ed727dce69dfac0518371d 0d15e853aa88da5375edd32b39d08a048b64a1c5 git | Not specified |
| CNA | Linux | Linux | affected dcdede0406d30e14a6ed727dce69dfac0518371d 8c77774535c3d6162929521a6fa11e3db086fa32 git | Not specified |
| CNA | Linux | Linux | affected dcdede0406d30e14a6ed727dce69dfac0518371d 8973f70cb068012d83cff1cfa3f45ef94ab02267 git | Not specified |
| CNA | Linux | Linux | affected dcdede0406d30e14a6ed727dce69dfac0518371d a2fde862b98db8908e2ebaffbb35a75a0e9d5b33 git | Not specified |
| CNA | Linux | Linux | affected dcdede0406d30e14a6ed727dce69dfac0518371d 074bb7cdc3e26afa698888ba56fc1df0e3f24650 git | Not specified |
| CNA | Linux | Linux | affected dcdede0406d30e14a6ed727dce69dfac0518371d 5f23e4e3a31dacfd82a8f56be253adc0910ee84f git | Not specified |
| CNA | Linux | Linux | affected dcdede0406d30e14a6ed727dce69dfac0518371d ca14c289ed9ffed6cc64290d039e923e5720a8bf git | Not specified |
| CNA | Linux | Linux | affected dcdede0406d30e14a6ed727dce69dfac0518371d 492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8 git | Not specified |
| CNA | Linux | Linux | affected 4.6 | Not specified |
| CNA | Linux | Linux | unaffected 4.6 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.273 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.224 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.191 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.161 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.115 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.59 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.13 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/a2fde862b98db8908e2ebaffbb35a75a0e9d5b33 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/074bb7cdc3e26afa698888ba56fc1df0e3f24650 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/5f23e4e3a31dacfd82a8f56be253adc0910ee84f | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/ca14c289ed9ffed6cc64290d039e923e5720a8bf | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/8c77774535c3d6162929521a6fa11e3db086fa32 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/0d15e853aa88da5375edd32b39d08a048b64a1c5 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/8973f70cb068012d83cff1cfa3f45ef94ab02267 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.