Description
In the Linux kernel, the following vulnerability has been resolved: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition The documentation of the function rvt_error_qp says both r_lock and s_lock need to be held when calling that function. It also asserts using lockdep that both of those locks are held. However, the commit I referenced in Fixes accidentally makes the call to rvt_error_qp in rvt_ruc_loopback no longer covered by r_lock. This results in the lockdep assertion failing and also possibly in a race condition.
References (6)
Core 6
Core References
Scores
CVSS v3
4.7
EPSS
0.0016
EPSS Percentile
5.1%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-667
CWE-362
Status
published
Products (23)
linux/Kernel
5.1.0 - 5.4.189linux
linux/Kernel
5.11.0 - 5.15.34linux
linux/Kernel
5.16.0 - 5.16.20linux
linux/Kernel
5.17.0 - 5.17.3linux
linux/Kernel
5.5.0 - 5.10.111linux
Linux/Linux
< 5.1
Linux/Linux
25636de95557a95d54ac30be94af3748345a0a90
Linux/Linux
5.0.4 - 5.1
Linux/Linux
5.1
Linux/Linux
5.10.111 - 5.10.*
... and 13 more
Published
Feb 26, 2025
Tracked Since
Feb 18, 2026