CVE-2021-47616

What it actually does

Use-after-free occurs when an error path in queue pair initialization frees a send queue but a subsequent reference drop triggers cleanup that attempts to free the already-released queue, allowing memory corruption in kernel space.

Why it matters to the business

Systems relying on RDMA networking may experience crashes, instability, or remote code execution, increasing risk of service disruption and data exposure especially in high-performance computing or storage environments.

How an attack unfolds

An attacker with local or network access triggers the error handling path during queue pair creation in the RDMA subsystem, causing the queue pointer to be used after it has been freed and potentially leading to arbitrary code execution or denial of service.

How to fix it

Update affected kernels or packages to versions containing the fix that zeros the queue pointer after free; for the listed repository apply commit d5a7655d6ea9e53ab57c3013092c5576da964bc4 or later.

How to confirm the fix worked

Confirm the queue pointer is zeroed immediately after the kfree call in rxe_qp_from_init and verify no subsequent use-after-free paths remain via code review or kernel memory debugging tools.

Typical attack path

1. Identify target system with RDMA/RXE enabled
2. Send crafted initialization requests that force the error path in rxe_qp_from_init
3. Trigger reference count drop to invoke cleanup on already-freed queue
4. Leverage resulting memory corruption for code execution or crash

How to detect it

Review kernel logs for RDMA/RXE queue cleanup errors, oops reports referencing rxe_queue_cleanup, and unexpected crashes during QP initialization; correlate with process activity involving RDMA verbs.

What your security team should do

• Apply the referenced commit or kernel update immediately on all RDMA-enabled systems
• Monitor for related memory safety issues in the RDMA subsystem
• Restrict RDMA interfaces to trusted networks where possible
• Test updated kernels in staging environments before production rollout