CVE-2026-64281: Linux Kernel RDMA Transport DoS Flaw

CVE-2026-64281 Overview

CVE-2026-64281 is a denial-of-service vulnerability in the Linux kernel's svcrdma module, which implements Remote Direct Memory Access (RDMA) transport for the kernel NFS server. Threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or sc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state during transport teardown. The stuck threads pin svc_xprt references and block svc_rdma_free(), preventing resource cleanup. The issue affects Linux kernel builds that use the server-side RDMA transport, commonly deployed for high-performance NFS over RDMA workloads.

Critical Impact
Remote peers can trigger a permanent hang of NFS-over-RDMA server threads by disconnecting at the wrong moment, exhausting server resources and requiring a reboot to recover.

Affected Products

Linux kernel builds with CONFIG_SUNRPC_XPRT_RDMA enabled (server side)
Kernel NFS servers exporting shares over RDMA transports
Distributions shipping affected upstream svcrdma code prior to the fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64281 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64281

Vulnerability Analysis

The vulnerability resides in the send-queue wait logic of the kernel's server-side RDMA transport (svcrdma). The close path sets the XPT_CLOSE flag before invoking xpo_detach, and both wait_event predicates test XPT_CLOSE. The predicates are only re-evaluated on wakeup, so parked threads never notice the close condition without an explicit wakeup.

The sc_sq_ticket_wait queue has no completion-driven wake path. It is advanced only by the chained ticket handoff inside svc_rdma_sq_wait(). When a close occurs without a wakeup, threads hold their svc_xprt_get reference indefinitely, and svc_rdma_free() blocks waiting for xpt_ref to reach zero.

Root Cause

Two close entry points expose the flaw. Local teardown runs svc_rdma_detach() via svc_handle_xprt() -> svc_delete_xprt() -> xpo_detach() on a worker thread. Remote disconnects arrive at svc_rdma_cma_handler(), which invokes svc_xprt_deferred_close(). That path sets XPT_CLOSE and enqueues the transport, but never touches either RDMA waitqueue. Workers already parked in svc_rdma_sq_wait() therefore never re-evaluate their predicates. When every worker is parked on the same transport, no thread remains to run the local teardown, and the wake site there becomes unreachable.

Attack Vector

A network-adjacent attacker holding an established RDMA connection to an affected NFS server can trigger the hang by disconnecting while server threads are parked waiting for send-queue tickets. The remote disconnect flows through svc_rdma_cma_handler() without waking the RDMA waitqueues. Repeated exploitation exhausts server worker threads and pins transport references, producing a persistent denial of service against the NFS-over-RDMA service. Refer to the upstream fix at Kernel Git Commit e5248a7 and Kernel Git Commit 40eedc4 for the code-level changes.

Detection Methods for CVE-2026-64281

Indicators of Compromise

Kernel worker threads stuck in TASK_UNINTERRUPTIBLE (D state) with stack traces including svc_rdma_sq_wait and svc_rdma_send.
hung_task warnings in dmesg referencing svcrdma symbols after RDMA client disconnects.
Growth in NFS server transport references without corresponding cleanup, visible via /proc/net/rpc/nfsd counters.

Detection Strategies

Monitor kernel logs for INFO: task ... blocked for more than N seconds messages containing svc_rdma_sq_wait or svc_rdma_free.
Track NFS RDMA session teardown events correlated with sustained worker-thread D-state counts.
Alert on abrupt drops in RDMA client connectivity paired with unresponsive NFS export mount points.

Monitoring Recommendations

Collect /proc/<pid>/stack from nfsd and kworker threads on RDMA-enabled servers and flag persistent svc_rdma_sq_wait frames.
Ingest dmesg and journald kernel messages into a centralized log platform and build detections for svcrdma hung-task signatures.
Track kernel version and patch state across NFS server fleets to identify hosts still exposed to CVE-2026-64281.

How to Mitigate CVE-2026-64281

Immediate Actions Required

Apply the upstream kernel fixes referenced by commits e5248a7 and 40eedc4, which introduce svc_rdma_xprt_deferred_close() and wake both waitqueues on teardown.
Rebuild or update to a distribution kernel that includes the svcrdma close-wake patch and reboot affected NFS servers.
Restrict RDMA connectivity to trusted client networks using fabric-level access controls until patched kernels are deployed.

Patch Information

The fix introduces svc_rdma_xprt_deferred_close(), a wrapper that calls svc_xprt_deferred_close() and then wakes both sc_sq_ticket_wait and sc_send_wait. Producers that previously called svc_xprt_deferred_close() directly (svc_rdma_cma_handler(), qp_event_handler(), svc_rdma_post_send_err(), svc_rdma_wc_send(), the sendto drop path, the rw completion error paths, and the recvfrom flush and read-list error paths) are converted to the new helper. Both waitqueues are also woken from svc_rdma_detach(). See Kernel Git Commit e5248a7 for the completing change.

Workarounds

Disable NFS-over-RDMA exports and fall back to TCP transport where feasible by removing the rdma protocol option from /etc/exports and restarting nfs-server.
Unload the svcrdma module on servers that do not require RDMA transport to eliminate the vulnerable code path.
Limit exposure by segmenting the RDMA fabric so only vetted client hosts can initiate connections to the NFS server.

bash

# Configuration example: disable server-side RDMA transport until patched
sudo systemctl stop nfs-server
sudo sh -c 'echo 0 > /proc/fs/nfsd/portlist_rdma' 2>/dev/null || true
sudo rmmod svcrdma 2>/dev/null || true
# Prevent automatic reload
echo 'blacklist svcrdma' | sudo tee /etc/modprobe.d/blacklist-svcrdma.conf
sudo systemctl start nfs-server