CVE-2026-74334
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, the RDMA/nldev subsystem has a locking issue when accessing the mr->pd pointer, which can change during rereg_mr. The fix uses mr->device instead of mr->pd->device and adds an rdma_restrack_sync() operation to safely access the PD restrack ID.
Risk Assessment
A race condition in data access can lead to incorrect behavior or system crashes during RDMA operations, potentially affecting the stability and security of environments using this technology.
Recommendation
It is recommended to apply the kernel patch that fixes this issue as soon as possible and to monitor security updates for your distribution.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Fix locking when accessing mr->pd Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer.