CVE-2026-80647 Overview
CVE-2026-80647 is a Linux kernel vulnerability in the HiSilicon Network Subsystem (HNS) RoCE (RDMA over Converged Ethernet) driver. The issue affects Completion Queue (CQ) handling in direct polling mode within the hns_roce_hw_v2 driver. Completion Queues allocated by ib_alloc_cq() always carry a comp_handler. Although direct mode never expects this handler to fire, the driver invokes it during a device reset, triggering a WARN_ONCE() in ib_cq_completion_direct(). The resulting kernel warning represents a driver correctness defect in the RDMA subsystem on HiSilicon hardware.
Critical Impact
The flaw produces kernel warnings during RDMA device reset events on HiSilicon hardware, indicating incorrect completion-handler dispatch that can affect stability of RDMA workloads.
Affected Products
- Linux kernel — RDMA subsystem (drivers/infiniband/hw/hns)
- HiSilicon hns_roce_hw_v2 RoCE driver
- Systems using HiSilicon RoCE adapters managed by the hclge driver
Discovery Timeline
- 2026-08-28 - CVE-2026-80647 published to the National Vulnerability Database
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80647
Vulnerability Analysis
The vulnerability resides in the Linux kernel RDMA/hns driver path that handles Completion Queue events during device reset. Completion Queues created through ib_alloc_cq() are assigned an internal comp_handler. When a consumer selects direct polling mode (IB_POLL_DIRECT), the kernel never expects this handler to run because the application polls the CQ directly. The hns_roce_hw_v2 driver violates this expectation during the reset flow: hns_roce_handle_device_err() calls hns_roce_cq_completion(), which in turn invokes the completion handler. The result is a WARN triggered by ib_cq_completion_direct().
The stack trace observed shows the call chain from hclge_service_task through hclge_reset_rebuild into hns_roce_hw_v2_reset_notify, ending at the warning site. While this is not a memory-safety flaw, it indicates flawed control flow between the RDMA core and the vendor driver during error and reset processing.
Root Cause
The root cause is that hns_roce_hw_v2 unconditionally invokes the CQ completion handler during device error and reset handling, without checking whether the CQ operates in direct polling mode. The RDMA core marks such CQs with a sentinel handler (ib_cq_completion_direct) whose only purpose is to emit a WARN_ONCE when incorrectly called.
Attack Vector
This is a locally observable driver defect triggered by RDMA device reset events on HiSilicon RoCE hardware. No network attacker interaction is required to produce the warning. The condition manifests during operational events such as adapter resets initiated by hclge_reset_service_task. The vulnerability's practical impact is limited to kernel log noise and potential downstream instability in RDMA workloads on affected hardware; there is no evidence of remote exploitation.
The fix, distributed across multiple stable-tree commits including 16138ea9833d, 1e56f8886d64, 3f19c2a3852e, 95b2e44bc1e5, 9f05319149c1, a075a7acd155, c028c1977b6e, and e7d363c0ffa8, adjusts the driver so that the CQ completion path respects direct-mode semantics and avoids invoking the sentinel handler.
Detection Methods for CVE-2026-80647
Indicators of Compromise
- Kernel log entries containing ib_cq_completion_direct in the call trace, originating from hns_roce_cq_completion and hns_roce_handle_device_err.
- WARN_ONCE messages emitted from the RDMA core on systems using the hns_roce_hw_v2 driver.
- Reset-related events logged by the hclge driver (hclge_reset_service_task, hclge_reset_rebuild) preceding the warning.
Detection Strategies
- Parse dmesg and /var/log/kern.log for stack traces referencing hns_roce_hw_v2 and ib_cq_completion_direct.
- Correlate RDMA adapter reset events with subsequent RDMA workload errors on HiSilicon-equipped hosts.
- Track kernel versions across the fleet and flag hosts running unpatched RDMA/hns code paths.
Monitoring Recommendations
- Ship kernel logs from RDMA-enabled hosts to a centralized log store for long-term retention and search.
- Alert on repeated hclge reset cycles, which can indicate underlying hardware or firmware faults that trigger the code path.
- Monitor RDMA application health metrics (completion latency, queue-pair errors) alongside kernel warnings for correlation.
How to Mitigate CVE-2026-80647
Immediate Actions Required
- Inventory Linux hosts using HiSilicon RoCE adapters and the hns_roce_hw_v2 driver.
- Apply the stable kernel updates that include the RDMA/hns fix commits referenced in the NVD advisory.
- Restart RDMA-dependent services after patching to ensure the corrected driver code path is loaded.
Patch Information
The fix is available in multiple Linux stable branches through the following upstream commits: Kernel Commit 16138ea, Kernel Commit 1e56f88, Kernel Commit 3f19c2a, Kernel Commit 95b2e44, Kernel Commit 9f05319, Kernel Commit a075a7a, Kernel Commit c028c19, and Kernel Commit e7d363c. Distribution-provided kernels that incorporate these commits close the issue.
Workarounds
- If patching is delayed, avoid unnecessary manual resets of HiSilicon RoCE devices to reduce exposure to the buggy code path.
- Where feasible, unload the hns_roce_hw_v2 module on hosts that do not require RDMA functionality.
- Suppress warning-driven alert fatigue by filtering the specific WARN_ONCE stack trace in log pipelines while retaining the underlying event for auditing.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.