Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31425— rds: ib: reject FRMR registration before IB connection is established

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在IB连接建立前接受FRMR注册，可能导致空指针取消引用。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.16% · P5

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1659185fb4d0025835eb2058a141f0746c5cab00< c506456ebf84c50ed9327473d4e9bd905def212b affected
1659185fb4d0025835eb2058a141f0746c5cab00< 82e4a3b56b23b844802056c9e75a39d24169b0a4 affected
1659185fb4d0025835eb2058a141f0746c5cab00< 450ec93c0f172374acbf236f1f5f02d53650aa2d affected
1659185fb4d0025835eb2058a141f0746c5cab00< 6b0a8de67ac0c74e1a7df92b73c862cb36780dfc affected
1659185fb4d0025835eb2058a141f0746c5cab00< a5bfd14c9a299e6db4add4440430ee5e010b03ad affected
1659185fb4d0025835eb2058a141f0746c5cab00< 23e07c340c445f0ebff7757ba15434cb447eb662 affected
1659185fb4d0025835eb2058a141f0746c5cab00< 47de5b73db3b88f45c107393f26aeba26e9e8fae affected
1659185fb4d0025835eb2058a141f0746c5cab00< a54ecccfae62c5c85259ae5ea5d9c20009519049 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31425

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rds: ib: reject FRMR registration before IB connection is established
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rds: ib: reject FRMR registration before IB connection is established rds_ib_get_mr() extracts the rds_ib_connection from conn->c_transport_data and passes it to rds_ib_reg_frmr() for FRWR memory registration. On a fresh outgoing connection, ic is allocated in rds_ib_conn_alloc() with i_cm_id = NULL because the connection worker has not yet called rds_ib_conn_path_connect() to create the rdma_cm_id. When sendmsg() with RDS_CMSG_RDMA_MAP is called on such a connection, the sendmsg path parses the control message before any connection establishment, allowing rds_ib_post_reg_frmr() to dereference ic->i_cm_id->qp and crash the kernel. The existing guard in rds_ib_reg_frmr() only checks for !ic (added in commit 9e630bcb7701), which does not catch this case since ic is allocated early and is always non-NULL once the connection object exists. KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:rds_ib_post_reg_frmr+0x50e/0x920 Call Trace: rds_ib_post_reg_frmr (net/rds/ib_frmr.c:167) rds_ib_map_frmr (net/rds/ib_frmr.c:252) rds_ib_reg_frmr (net/rds/ib_frmr.c:430) rds_ib_get_mr (net/rds/ib_rdma.c:615) __rds_rdma_map (net/rds/rdma.c:295) rds_cmsg_rdma_map (net/rds/rdma.c:860) rds_sendmsg (net/rds/send.c:1363) ____sys_sendmsg do_syscall_64 Add a check in rds_ib_get_mr() that verifies ic, i_cm_id, and qp are all non-NULL before proceeding with FRMR registration, mirroring the guard already present in rds_ib_post_inv(). Return -ENODEV when the connection is not ready, which the existing error handling in rds_cmsg_send() converts to -EAGAIN for userspace retry and triggers rds_conn_connect_if_down() to start the connection worker.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在IB连接建立前接受FRMR注册，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1659185fb4d0025835eb2058a141f0746c5cab00 ~ c506456ebf84c50ed9327473d4e9bd905def212b -
Linux Linux 4.6 -

II. Public POCs for CVE-2026-31425

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31425

请登录查看更多情报信息。

Same Patch Batch · Linux · 2026-04-13 · 15 CVEs total

CVE-2026-31414 9.8 CRITICAL netfilter: nf_conntrack_expect: use expect->helper
CVE-2026-31419 7.8 HIGH net: bonding: fix use-after-free in bond_xmit_broadcast()
CVE-2026-31417 7.5 HIGH net/x25: Fix overflow when accumulating packets
CVE-2026-31426 7.0 HIGH ACPI: EC: clean up handlers on probe failure in acpi_ec_setup()
CVE-2026-31428 netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
CVE-2026-31427 netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
CVE-2026-31424 netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
CVE-2026-31423 net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
CVE-2026-31422 net/sched: cls_flow: fix NULL pointer dereference on shared blocks
CVE-2026-31420 bridge: mrp: reject zero test interval to avoid OOM panic
CVE-2026-31421 net/sched: cls_fw: fix NULL pointer dereference on shared blocks
CVE-2026-31418 netfilter: ipset: drop logically empty buckets in mtype_del
CVE-2026-31416 netfilter: nfnetlink_log: account for netlink header size
CVE-2026-31415 ipv6: avoid overflows in ip6_datagram_send_ctl()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31425

No comments yet

Leave a comment