CVE-2026-43469 Overview
CVE-2026-43469 is a denial-of-service vulnerability in the Linux kernel's xprtrdma (RPC over RDMA) transport module. The flaw resides in rpcrdma_post_recvs(), which fails to decrement the ep->re_receiving counter on early exit paths. When the function fails to create a work request due to memory allocation failure, the counter never reaches zero. This causes rpcrdma_xprt_drain() to wait indefinitely for a completion that will never occur, hanging kernel worker threads on systems using NFS over RDMA.
Critical Impact
Remote, unauthenticated attackers can trigger a hang in kernel worker threads on systems under memory pressure, resulting in a high-availability impact on NFS/RDMA workloads.
Affected Products
- Linux kernel xprtrdma module (RPC over RDMA transport)
- sunrpc subsystem consumers using RDMA transports
- NFS clients and servers leveraging RDMA fabrics (RoCE, InfiniBand, iWARP)
Discovery Timeline
- 2026-05-08 - CVE-2026-43469 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43469
Vulnerability Analysis
The vulnerability stems from improper state management in the xprtrdma receive-posting path. The function rpcrdma_post_recvs() increments ep->re_receiving upon entry to indicate active receive operations. The counter must be decremented on every return path so that rpcrdma_xprt_drain() can detect quiescence and trigger its completion.
When the function exits early — for example, when work request allocation fails under memory pressure — the decrement is skipped. The counter remains non-zero indefinitely, and any subsequent transport teardown blocks. The hung task trace shows kworker/u385:17 stuck in wait_for_completion() from rpcrdma_xprt_disconnect() via xprt_autoclose().
The impact is limited to availability, with no confidentiality or integrity loss. The bug is reachable through normal NFS-over-RDMA traffic when the system encounters allocation failures, making it a resource-exhaustion DoS class of issue [CWE-772 missing release of resource].
Root Cause
The root cause is an unbalanced reference counter in error-handling paths. rpcrdma_post_recvs() increments ep->re_receiving once but lacks the corresponding decrement on early returns. The fix introduces goto-based cleanup or explicit decrement statements at each premature exit point to guarantee balanced counter operations.
Attack Vector
An attacker does not need direct access to exploit the condition. Any workload that drives the xprtrdma transport while the system is under memory pressure can trigger the hang. On a server exposing NFS over RDMA, a remote client generating sustained RPC traffic during low-memory conditions can induce the deadlock and stall NFS service.
No exploitation code is publicly available. The vulnerability surfaces operationally rather than through a crafted exploit payload. See the upstream commit references for the precise code changes that restore counter balance.
Detection Methods for CVE-2026-43469
Indicators of Compromise
- Kernel hung_task warnings referencing kworker threads blocked in rpcrdma_xprt_disconnect and wait_for_completion
- Stalled xprtiod workqueue items invoking xprt_autoclose from the sunrpc module
- NFS mounts over RDMA becoming unresponsive after periods of high memory pressure
Detection Strategies
- Monitor dmesg and journal logs for task ... blocked for more than 122 seconds entries with rpcrdma in the call trace
- Alert on repeated xprt_autoclose invocations correlated with allocation failure messages such as page allocation failure or OOM events
- Track NFS client mount latency and RDMA completion queue depth for sudden drops to zero
Monitoring Recommendations
- Enable CONFIG_DETECT_HUNG_TASK and forward kernel hung-task warnings to centralized logging
- Collect ftrace or bpftrace telemetry on rpcrdma_post_recvs return paths to verify counter balance
- Capture /proc/sys/sunrpc/rpc_debug data and RDMA driver counters during memory-pressure events
How to Mitigate CVE-2026-43469
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced below to all hosts running NFS over RDMA
- Inventory systems using xprtrdma by checking for the loaded rpcrdma module and active RDMA NFS mounts
- Prioritize patching on hosts that experience memory pressure or run mixed NFS/RDMA workloads
Patch Information
The fix is committed upstream across multiple stable branches. Refer to the kernel.org commits: Linux Kernel Fix Commit 49f53ee, Linux Kernel Fix Commit 74c39a4, Linux Kernel Fix Commit 7b6275c, Linux Kernel Fix Commit 7ea6925, Linux Kernel Fix Commit 8127b5f, Linux Kernel Fix Commit 8cb6b5d, and Linux Kernel Fix Commit dc3ebd7. Consume the patched kernel package from your distribution vendor when available.
Workarounds
- Switch affected NFS mounts from RDMA transport to TCP by removing the proto=rdma mount option until the kernel patch is applied
- Reduce memory pressure on hosts by tuning vm.min_free_kbytes and limiting workloads that compete with the RDMA stack
- Unload the rpcrdma module on systems that do not require RDMA-based NFS
# Temporarily switch NFS mounts away from RDMA transport
umount /mnt/nfs-rdma
mount -t nfs -o vers=4.2,proto=tcp server:/export /mnt/nfs-tcp
# Verify the rpcrdma module is not in use, then unload
lsmod | grep rpcrdma
rmmod rpcrdma
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
