CVE-2021-47378

What it actually does

Use-after-free in the nvme-rdma driver when a CM ID is not destroyed before the QP during RDMA connection establishment error handling, allowing a CMA event to access already-freed memory and resulting in kernel memory corruption.

Why it matters to the business

Linux systems relying on NVMe over RDMA storage may suffer kernel crashes, data corruption, or remote code execution; impact is highest in high-performance storage and data-center environments though public exploitation remains limited.

How an attack unfolds

An attacker forces an error path during RDMA queue allocation; the driver destroys the QP while the CM ID still exists, so a subsequent CMA event handler dereferences the freed QP structure for memory corruption or code execution.

How to fix it

Apply a Linux kernel containing the fix that ensures the CM ID is always destroyed before the QP in nvme-rdma error paths; rebuild and reboot affected hosts with the corrected kernel.

How to confirm the fix worked

Confirm the presence of the upstream commit that reorders CM ID destruction ahead of QP destruction in the nvme-rdma error handler; run targeted RDMA connection-error tests to verify no use-after-free occurs.

Typical attack path

1. Initiate or interfere with an NVMe RDMA connection to trigger an error flow
2. Cause nvme_rdma_alloc_queue to destroy the QP before the CM ID
3. Deliver a CMA event that accesses the now-freed QP memory
4. Leverage the resulting use-after-free for kernel-level code execution or denial of service

How to detect it

Review kernel logs and crash dumps for use-after-free reports or oops messages referencing nvme-rdma, rdma_cm, or qp destruction during connection setup; correlate with RDMA connection error events.

What your security team should do

• Patch Linux kernels supporting NVMe RDMA at the earliest maintenance window
• Temporarily disable or restrict RDMA interfaces on unpatched systems where feasible
• Monitor kernel update channels for backported fixes to older LTS branches