CVE-2026-31565: Linux Kernel RDMA/irdma DOS Vulnerability

CVE-2026-31565 Overview

A deadlock vulnerability has been identified in the Linux kernel's RDMA/irdma driver that occurs during network device reset operations when RDMA applications are active. The vulnerability affects the Intel iWARP (Internet Wide Area RDMA Protocol) implementation and can cause system instability or denial of service conditions when network administration tasks coincide with RDMA workloads.

Critical Impact
Local authenticated attackers can trigger a system deadlock by initiating a netdev reset while RDMA applications (such as rping) are active, causing complete system unavailability requiring a hard reboot.

Affected Products

Linux Kernel versions prior to patched releases
Linux Kernel 6.4.x series
Linux Kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

April 24, 2026 - CVE-2026-31565 published to NVD
April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31565

Vulnerability Analysis

This vulnerability exists in the RDMA/irdma driver subsystem, specifically in how it handles device cleanup during network interface reset operations. The deadlock condition arises from improper synchronization between the user-space verbs client (uverbs_client) and the connection manager client (cma_client) during device removal sequences.

When a user executes a network device reset (such as through ip link set down/up or driver reload), the ice driver removes the irdma auxiliary driver. This triggers device_delete and subsequent client removal procedures. During this cleanup phase, the uverbs_client waits for the Queue Pair (QP) reference count to reach zero. However, the cma_client holds the final reference to the QP, creating a circular dependency that results in an indefinite wait state.

This deadlock manifests specifically in iWARP mode and represents a classic CWE-667 (Improper Locking) condition where two components are waiting for each other to release resources, neither of which can proceed.

Root Cause

The root cause is a circular dependency in the reference counting mechanism between the uverbs_client and cma_client components during device teardown. The uverbs_client component blocks waiting for QP references to be released, while cma_client cannot release its held reference because it is blocked by the same teardown sequence. The fix skips the QP reference count wait during device reset operations to prevent this deadlock scenario.

Attack Vector

The attack requires local access with low privileges. An authenticated user with the ability to execute network administration commands or trigger network device resets can exploit this vulnerability to cause a denial of service. The attack scenario involves:

Active RDMA connections established using applications like rping, ib_write_bw, or similar
Attacker initiates a network device reset via standard network administration tools
The irdma driver enters the device removal sequence
Deadlock occurs between uverbs_client and cma_client reference counting
System becomes unresponsive, requiring a hard reboot

The vulnerability is exploitable without specialized tools—standard networking utilities such as ip, ifconfig, or driver reload commands are sufficient to trigger the condition when RDMA applications are running.

Detection Methods for CVE-2026-31565

Indicators of Compromise

Kernel stack traces showing blocking operations in irdma_remove or irdma_ib_unregister_device functions
System hangs coinciding with network interface reset operations on Intel NICs with RDMA capabilities
Kernel log messages indicating QP reference count wait timeouts or hung task warnings in the RDMA subsystem

Detection Strategies

Monitor for hung task warnings in /var/log/kern.log or dmesg output mentioning irdma or RDMA components
Implement watchdog monitoring for system responsiveness during network administration operations
Review kernel traces for blocked processes in RDMA driver removal paths using sysrq-t or crash dump analysis

Monitoring Recommendations

Enable kernel hung task detection with appropriate timeout values
Configure alerting on kernel deadlock or hung task detector warnings
Monitor RDMA application availability and connection states during network maintenance windows

How to Mitigate CVE-2026-31565

Immediate Actions Required

Ensure RDMA applications are gracefully terminated before performing network device resets or driver reloads
Schedule network maintenance windows during periods of low RDMA activity
Update to patched kernel versions as soon as they become available for your distribution

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix modifies the device removal logic to skip the QP reference count wait during device reset operations, breaking the circular dependency.

Multiple patch commits are available across different stable kernel branches:

Workarounds

Gracefully terminate all RDMA applications before performing any network interface operations on affected Intel NICs
Implement operational procedures requiring RDMA workload quiesce before network maintenance
Consider disabling iWARP mode if not required, as the vulnerability specifically affects iWARP operations

bash

# Check for active RDMA connections before network reset
rdma resource show qp

# Gracefully stop RDMA applications before network operations
systemctl stop rdma-applications.service

# Verify no active QP before reset
ibv_devinfo -v | grep -i qp