CVE-2026-31425 - Vulnerability Details

- rds: ib: reject FRMR registration before IB connection is established

Description

In the Linux kernel, the following vulnerability has been resolved:

rds: ib: reject FRMR registration before IB connection is established

rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data
and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a
fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with
i_cm_id = NULL because the connection worker has not yet called
rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with
RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses
the control message before any connection establishment, allowing
rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the
kernel.

The existing guard in rds_ib_reg_frmr() only checks for !ic (added in
commit 9e630bcb7701), which does not catch this case since ic is allocated
early and is always non-NULL once the connection object exists.

KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920
Call Trace:
rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167)
rds_ib_map_frmr (net/rds/ib_frmr.c:252)
rds_ib_reg_frmr (net/rds/ib_frmr.c:430)
rds_ib_get_mr (net/rds/ib_rdma.c:615)
__rds_rdma_map (net/rds/rdma.c:295)
rds_cmsg_rdma_map (net/rds/rdma.c:860)
rds_sendmsg (net/rds/send.c:1363)
____sys_sendmsg
do_syscall_64

Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all
non-NULL before proceeding with FRMR registration, mirroring the guard
already present in rds_ib_post_inv(). Return -ENODEV when the connection
is not ready, which the existing error handling in rds_cmsg_send() converts
to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to
start the connection worker.

Published: 2026-04-13

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability occurs in the Linux kernel RDS IB module. The code attempts to register a memory region (FRMR) before the underlying RDMA connection is fully established, causing a null‑pointer dereference in rds_ib_post_reg_frmr. The resulting kernel fault crashes the system, providing a denial‑of‑service vector. The weakness corresponds to a null pointer dereference (CWE‑476).

Affected Systems

All Linux kernel releases that include the vulnerable rds_ib_get_mr implementation are affected. The vulnerability is present until the patch included in commit 23e07c340c445f0ebff7757ba15434cb447eb662 (and related commits) is applied. No specific vendor version ranges are provided, so any kernel version before this fix should be considered vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack vector is inferred to be local: an application with permission to call sendmsg on an RDS socket can trigger the fault before the RDMA connection is established. While the impact is limited to a kernel crash, the risk remains significant for critical systems that rely on uninterrupted kernel operation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1659185fb4d0025835eb2058a141f0746c5cab00`	affected	< 450ec93c0f172374acbf236f1f5f02d53650aa2d
`1659185fb4d0025835eb2058a141f0746c5cab00`	affected	< 6b0a8de67ac0c74e1a7df92b73c862cb36780dfc
`1659185fb4d0025835eb2058a141f0746c5cab00`	affected	< a5bfd14c9a299e6db4add4440430ee5e010b03ad
`1659185fb4d0025835eb2058a141f0746c5cab00`	affected	< 23e07c340c445f0ebff7757ba15434cb447eb662
`1659185fb4d0025835eb2058a141f0746c5cab00`	affected	< 47de5b73db3b88f45c107393f26aeba26e9e8fae
`1659185fb4d0025835eb2058a141f0746c5cab00`	affected	< a54ecccfae62c5c85259ae5ea5d9c20009519049

Linux

affected

Version	Status	Constraints
`4.6`	affected	—
`0`	unaffected	< 4.6
`6.1.168`	unaffected	≤ 6.1.*
`6.6.134`	unaffected	≤ 6.6.*
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1659185fb4d0025835eb2058a141f0746c5cab00,450ec93c0f172374acbf236f1f5f02d53650aa2d)`	affected	code_commit	—
`[1659185fb4d0025835eb2058a141f0746c5cab00,6b0a8de67ac0c74e1a7df92b73c862cb36780dfc)`	affected	code_commit	—
`[1659185fb4d0025835eb2058a141f0746c5cab00,a5bfd14c9a299e6db4add4440430ee5e010b03ad)`	affected	code_commit	—
`[1659185fb4d0025835eb2058a141f0746c5cab00,23e07c340c445f0ebff7757ba15434cb447eb662)`	affected	code_commit	—
`[1659185fb4d0025835eb2058a141f0746c5cab00,47de5b73db3b88f45c107393f26aeba26e9e8fae)`	affected	code_commit	—
`[1659185fb4d0025835eb2058a141f0746c5cab00,a54ecccfae62c5c85259ae5ea5d9c20009519049)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.6`	affected	generic	—
`[0,4.6)`	unaffected	generic	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.134,6.7.0)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the rds: ib null pointer dereference fix (commit 23e07c340c445f0ebff7757ba15434cb447eb662 or newer).
If an immediate kernel upgrade is not possible, restart the system to clear any affected socket state and mitigate the risk of accidental crashes.
Verify that no RDS_CMSG_RDMA_MAP control messages are sent before the RDMA connection is established; consider updating applications to ensure proper connection sequencing.

Generated by OpenCVE AI on April 14, 2026 at 01:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/23e07c340c445f0ebff7757ba15434cb447eb662
https://git.kernel.org/stable/c/450ec93c0f172374acbf236f1f5f02d53650aa2d
https://git.kernel.org/stable/c/47de5b73db3b88f45c107393f26aeba26e9e8fae
https://git.kernel.org/stable/c/6b0a8de67ac0c74e1a7df92b73c862cb36780dfc
https://git.kernel.org/stable/c/a54ecccfae62c5c85259ae5ea5d9c20009519049
https://git.kernel.org/stable/c/a5bfd14c9a299e6db4add4440430ee5e010b03ad
https://lore.kernel.org/linux-cve-announce/2026041357-CVE-2026-31425-40d3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31425
https://www.cve.org/CVERecord?id=CVE-2026-31425

History

Tue, 14 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://lore.kernel.org/linux-cve-announce/2026041357-CVE-2026-31425-40d3@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31425 https://www.cve.org/CVERecord?id=CVE-2026-31425
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 13 Apr 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: rds: ib: reject FRMR registration before IB connection is established rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with i_cm_id = NULL because the connection worker has not yet called rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses the control message before any connection establishment, allowing rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the kernel. The existing guard in rds_ib_reg_frmr() only checks for !ic (added in commit 9e630bcb7701), which does not catch this case since ic is allocated early and is always non-NULL once the connection object exists. KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920 Call Trace: rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167) rds_ib_map_frmr (net/rds/ib_frmr.c:252) rds_ib_reg_frmr (net/rds/ib_frmr.c:430) rds_ib_get_mr (net/rds/ib_rdma.c:615) __rds_rdma_map (net/rds/rdma.c:295) rds_cmsg_rdma_map (net/rds/rdma.c:860) rds_sendmsg (net/rds/send.c:1363) ____sys_sendmsg do_syscall_64 Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all non-NULL before proceeding with FRMR registration, mirroring the guard already present in rds_ib_post_inv(). Return -ENODEV when the connection is not ready, which the existing error handling in rds_cmsg_send() converts to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to start the connection worker.
Title		rds: ib: reject FRMR registration before IB connection is established
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/23e07c340c445f0ebff7757ba15434cb447eb662 https://git.kernel.org/stable/c/450ec93c0f172374acbf236f1f5f02d53650aa2d https://git.kernel.org/stable/c/47de5b73db3b88f45c107393f26aeba26e9e8fae https://git.kernel.org/stable/c/6b0a8de67ac0c74e1a7df92b73c862cb36780dfc https://git.kernel.org/stable/c/a54ecccfae62c5c85259ae5ea5d9c20009519049 https://git.kernel.org/stable/c/a5bfd14c9a299e6db4add4440430ee5e010b03ad

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-13T13:40:28.911Z

Updated: 2026-04-13T13:40:28.911Z

Reserved: 2026-03-09T15:48:24.088Z

Link: CVE-2026-31425

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-13T14:16:12.420

Modified: 2026-04-13T15:01:43.663

Link: CVE-2026-31425

Redhat

Severity : Moderate

Publid Date: 2026-04-13T00:00:00Z

Links: CVE-2026-31425 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-14T16:34:23Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object