CVE-2021-47026

What it actually does

Use-after-free where sess->stats object is freed by rtrs_clt_remove_path_from_sysfs before the session is removed from the active list, allowing concurrent calls in rtrs_clt_request or get_next_path_min_inflight to access the freed object despite status checks.

Why it matters to the business

Can cause kernel instability, crashes, or potential privilege escalation on Linux systems using RDMA/rtrs-clt for high-performance storage or networking fabrics.

How an attack unfolds

An attacker with local access triggers dynamic path removal via the remove_path sysfs interface while concurrent RDMA IO operations race to check session state and update statistics, resulting in use-after-free access to the freed sess->stats object.

How to fix it

Apply the upstream kernel commit that reorders rtrs_clt_remove_path_from_sysfs to remove the session from the active list before destroying sysfs interfaces and freeing stats.

How to confirm the fix worked

Confirm the fix by inspecting the rtrs_clt_remove_path_from_sysfs function to ensure active-list removal precedes sysfs teardown, and test concurrent remove_path and IO workloads for absence of UAF reports.

Typical attack path

1. Obtain local user access on an affected Linux host
2. Interact with the rtrs-clt sysfs remove_path interface while RDMA IO is active
3. Trigger the race to dereference the freed stats object and achieve memory corruption or code execution

How to detect it

Search kernel logs and crash dumps for use-after-free reports, oops traces, or references to rtrs_clt_sess stats objects during path removal or IO request paths.

What your security team should do

• Prioritize kernel updates on all systems exposing RDMA/rtrs-clt
• Restrict unprivileged write access to the relevant sysfs paths
• Monitor kernel logs for rtrs_clt UAF or oops patterns