Cloudanix VulnDB

CVE-2026-80647

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver bug could cause warning messages to appear when certain network hardware resets, without creating any risk of data theft or system takeover.

Exploitation
Other
Attacker needs
None
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Low
Patch risk
None

What it actually does

Triggers WARN_ONCE() in ib_cq_completion_direct when the RDMA completion handler is invoked during hns_roce driver reset in direct poll mode despite no handler being expected.

Why it matters to the business

Produces spurious kernel warnings during normal RDMA device resets on affected hardware, potentially complicating troubleshooting and indicating driver instability without impacting data integrity or availability.

How an attack unfolds

No malicious exploitation path exists; the condition surfaces only during legitimate driver reset sequences initiated by hardware error handling or service tasks in the hns_roce_hw_v2 and hclge modules.

How to fix it

Apply the upstream kernel commit that resolves the completion handler invocation in direct mode for RDMA/hns; rebuild and deploy updated kernel packages containing the fix.

How to confirm the fix worked

Confirm absence of the call trace involving ib_cq_completion_direct and hns_roce_cq_completion in dmesg or kernel logs during simulated or observed device resets after patching.

How to detect it

Search kernel logs and dmesg for the specific call trace starting with ib_cq_completion_direct and including hns_roce_cq_completion plus hns_roce_handle_device_err.

  • ib_cq_completion_direct+0x38/0x60
  • hns_roce_cq_completion+0x54/0x90
  • hns_roce_handle_device_err
  • WARN_ONCE triggered in direct mode CQ

What your security team should do

  • Update Linux kernels on systems using hns_roce RDMA hardware to versions containing the resolution
  • Monitor kernel logs for related WARN_ONCE entries as a temporary detection measure
  • Prioritize patching on production RDMA clusters once fixed kernels are available

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix warning in poll cq direct mode CQs allocated by ib_alloc_cq() always have a comp_handler. Though in direct mode this handler is never expected to be called, it is still called when the driver is reset, triggering the following WARN_ONCE(): Call trace: ib_cq_completion_direct+0x38/0x60 hns_roce_cq_completion+0x54/0x90 (hns_roce_hw_v2] hns_roce_handle_device_err+Ox1c8/0x340 [hns_roce_hw_v2] hns_roce_hw_v2_uninit_instance.constprop.0+0x34/0x70 [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify+0xc4/0xe0 [hns_roce_hw_v2] hclge_notify_roce_client+0x60/0xbc [hclge] hclge_reset_rebuild+0x48/0x34c [hclge] hclge_reset_subtask+0xcc/0xec [hclge] hclge_reset_service_task+0x80/0x160 [hclge] hclge_service_task+0x50/0x80 (hclge] process_one_work+0x1cc/0x4d0 worker_thread+0x154/0x414 kthread+0x104/0x144 ret_from_fork+0x10/0x18

Affected packages

Ecosystem Package Introduced Fixed