CVE-2021-47001

What it actually does

Race condition in the Linux kernel xprtrdma module where the reply handler can open the congestion window and allow additional RPC calls before rpcrdma_post_recvs has posted sufficient Receive work requests, resulting in RNR errors and immediate connection loss after reconnect.

Why it matters to the business

Intermittent loss of high-performance RDMA-based NFS connections can disrupt storage access, increase latency, and cause application failures in environments relying on kernel RDMA transport.

How an attack unfolds

An attacker with the ability to trigger repeated reconnects on an RDMA-enabled NFS mount can force the race window open, causing the reply handler to post sends before receives are ready and terminating the new connection via RNR errors.

How to fix it

Apply the upstream kernel commit that corrects cwnd update ordering relative to rpcrdma_post_recvs, or upgrade to a kernel release containing the fix for this race condition.

How to confirm the fix worked

Confirm the presence of the ordering fix in the xprtrdma reply handler and rpcrdma_rep_create path; test under KASAN with injected disconnects to ensure no RNR occurs before receives are posted.

Typical attack path

1. Trigger a disconnect on an active xprtrdma connection
2. Force rapid reconnect and RPC activity before receive buffers are posted
3. Exploit the ordering flaw to generate RNR completions and drop the connection
4. Repeat to sustain denial of service on RDMA transport

How to detect it

Review kernel logs for repeated RNR NAKs or xprtrdma connection resets immediately following reconnect events; correlate with NFS/RDMA activity under high reconnect rates.

What your security team should do

• Prioritize kernel updates for systems using NFS over RDMA
• Monitor for unexpected RDMA connection resets in logs
• Disable RDMA transport where not required until patched