CVE-2026-80625 Overview
CVE-2026-80625 is a memory leak vulnerability in the Linux kernel's HiSilicon Network Subsystem (HNS) RoCE (RDMA over Converged Ethernet) driver. The flaw occurs when driver removal and driver reset execute concurrently. Bonding resources are released in hns_roce_hw_v2_exit() during driver removal, then reallocated in hns_roce_register_device() during driver reset. The reallocation happens after the intended release window, producing a memory leak. The condition can also trigger a kernel panic through a leaked notifier callback invoked by netdev_lower_state_changed().
Critical Impact
Concurrent driver removal and reset paths leak bonding resources and can crash the kernel through a stale notifier callback in the RDMA/hns driver.
Affected Products
- Linux kernel RDMA/hns driver (HiSilicon RoCE)
- Kernel builds containing the hns_roce_hw_v2_exit() and hns_roce_register_device() teardown paths prior to the fix
- Distributions shipping the pre-patch mainline sources referenced in the upstream commits
Discovery Timeline
- 2026-08-28 - CVE-2026-80625 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80625
Vulnerability Analysis
The defect lives in the HNS RoCE driver's lifecycle management. During normal shutdown, hns_roce_hw_v2_exit() releases the bonding resources associated with the RDMA device. When a driver reset runs concurrently with removal, hns_roce_register_device() allocates a fresh set of bonding resources after the removal path has already executed its teardown step. Because the release phase has passed, the newly allocated resources are never freed, producing the leak.
The leak extends beyond memory accounting. The bonding subsystem registers a notifier callback tied to lower-state changes on the underlying netdev. When that callback survives beyond the lifetime of the driver context, later invocations of raw_notifier_call_chain and call_netdevice_notifiers_info dereference stale state. The observed call trace transits netdev_lower_state_changed into freed memory, resulting in a kernel panic.
Root Cause
The root cause is an incorrect teardown ordering between bonding resource release and driver deregistration. Removal releases bonding state before the register path is guaranteed to be quiesced. A concurrent reset then re-enters hns_roce_register_device() and reallocates state that the removal path will not revisit. Inverting the teardown order so bonding resources are released after driver deregistration closes the window.
Attack Vector
Triggering the flaw requires local conditions that produce concurrent RDMA/hns driver removal and reset. This is a stability and reliability defect rather than a network-reachable attack surface. The security-relevant outcomes are host denial of service through kernel panic and resource exhaustion through repeated leaks over reset cycles. The upstream commits referenced in the Kernel Git Commit Update and the companion patch contain the corrected teardown sequence.
Detection Methods for CVE-2026-80625
Indicators of Compromise
- Kernel panic call traces containing raw_notifier_call_chain, call_netdevice_notifiers_info, and netdev_lower_state_changed on hosts using HiSilicon RoCE hardware.
- Growing slab or kmalloc accounting attributable to the RDMA/hns driver across reset cycles.
- dmesg entries showing repeated hns_roce_register_device() invocations without matching cleanup during driver removal.
Detection Strategies
- Correlate host telemetry for RDMA/hns driver load, unload, and reset events with kernel oops or panic records.
- Track kernel memory growth on RDMA-enabled hosts using /proc/slabinfo and /proc/meminfo baselines, flagging monotonically increasing driver-attributed allocations.
- Alert on netdev notifier chain faults referencing HNS symbols in crash dumps.
Monitoring Recommendations
- Ingest dmesg, kdump, and crash reports into a centralized log platform for pattern matching against the documented call trace.
- Monitor uptime and unexpected reboots on hosts operating HiSilicon RoCE NICs, especially those in bonded configurations.
- Watch for scheduled or automated processes that combine driver reload with reset workflows, which raise the probability of the race.
How to Mitigate CVE-2026-80625
Immediate Actions Required
- Apply the upstream kernel patches referenced in the mainline commits bc4caea7a82bbcf94a34eff7094e7f9b501680ab and c0bd03b850d81a8914168d87ddf7f6ffa58875ef.
- Update to a distribution kernel that incorporates the corrected teardown ordering in the RDMA/hns driver.
- Audit change-management runbooks to eliminate concurrent driver removal and reset operations on HNS RoCE hosts until patched.
Patch Information
The fix inverts the teardown order so that bonding resources are released after driver deregistration completes. This removes the window in which hns_roce_register_device() can reallocate bonding state that the removal path will never free. Patch details are available in the Kernel Git Commit Update and the related fix commit.
Workarounds
- Avoid triggering driver reset while an rmmod or driver-removal workflow is in progress on affected hosts.
- Serialize administrative operations against the RDMA/hns driver to prevent concurrent lifecycle transitions.
- Where feasible, disable bonded configurations on HNS RoCE interfaces until the patched kernel is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.