What’s Vulnerable › Vulnerabilities

CVE-2021-47378: nvme-rdma: destroy cm id before destroy qp to avoid use after free

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-21 · updated 2026-06-17
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use after free. In RDMA connection establishment error flow, don't destroy qp in cm event handler.Just report cm_error to upper level, qp will be destroy in nvme_rdma_alloc_queue() after destroy cm id.

Affected products

• Linux kernel: before 5.10.70; from 5.11 before 5.14.9; 5.15-rc1 — fixed in 5.10.70, 5.14.9

How to fix

Upgrade to a fixed version: Linux kernel 5.10.70, 5.14.9. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744
• https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994
• https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f
• https://git.kernel.org/stable/c/9817d763dbe15327b9b3ff4404fa6f27f927e744
• https://git.kernel.org/stable/c/d268a182c56e8361e19fb781137411643312b994
• https://git.kernel.org/stable/c/ecf0dc5a904830c926a64feffd8e01141f89822f

Get alerted when CVE-2021-47378 or the next vulnerability affects your stack