CVE-2026-31425: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31425 is a NULL pointer dereference vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) InfiniBand (IB) transport layer, specifically in the FRMR (Fast Registration Memory Region) registration path. It was published on April 13, 2026, and affects Linux kernel versions from 4.6 through multiple stable branches, including versions before 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, and 6.19.12, as well as 7.0 release candidates. The vulnerability allows a local attacker with low privileges to crash the kernel by triggering a null pointer dereference in rds_ib_post_reg_frmr(). It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in rds_ib_get_mr() within the Linux kernel's RDS IB subsystem. On a fresh outgoing RDS connection, rds_ib_conn_alloc() allocates the rds_ib_connection structure (ic) with i_cm_id = NULL, because the connection worker has not yet called rds_ib_conn_path_connect() to initialize the rdma_cm_id. When a local user calls sendmsg() with the RDS_CMSG_RDMA_MAP control message on such an unestablished connection, the code path proceeds to rds_ib_post_reg_frmr(), which dereferences ic->i_cm_id->qp without verifying that i_cm_id is non-NULL, causing a kernel crash. The existing guard in rds_ib_reg_frmr() only checks for !ic (introduced in commit 9e630bcb7701), which is insufficient since ic is always non-NULL once the connection object exists. The fix adds a check in rds_ib_get_mr() verifying that ic, i_cm_id, and qp are all non-NULL before proceeding, returning -ENODEV when the connection is not ready (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel panic (denial of service) on the affected system, as the null pointer dereference in rds_ib_post_reg_frmr() results in a KASAN-detected crash (null-ptr-deref in range [0x0000000000000010-0x0000000000000017]). There is no confidentiality or integrity impact; the vulnerability is limited to availability. The affected scope is systems running Linux kernels with RDS over InfiniBand enabled, particularly those used in high-performance computing or RDMA-capable environments (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges (e.g., the ability to create RDS sockets and call sendmsg() with RDS_CMSG_RDMA_MAP). The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Gain local access: Obtain a local user account on a Linux system with RDS over InfiniBand enabled and the rds kernel module loaded.
2. Create an RDS socket: Open an RDS socket using socket(AF_RDS, SOCK_SEQPACKET, 0) targeting an InfiniBand-backed connection.
3. Initiate a fresh outgoing connection: Bind the socket to a local address and attempt to connect to a remote address, ensuring the connection worker has not yet completed rdma_cm_id initialization (i.e., i_cm_id remains NULL).
4. Send a crafted control message: Call sendmsg() with a RDS_CMSG_RDMA_MAP control message (cmsg_type = RDS_CMSG_RDMA_MAP) on the unestablished connection before the IB connection is fully set up.
5. Trigger null pointer dereference: The kernel processes the control message, calls rds_ib_get_mr() → rds_ib_reg_frmr() → rds_ib_post_reg_frmr(), which dereferences ic->i_cm_id->qp with i_cm_id = NULL, causing a kernel panic and system crash (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel crash logs containing KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] with a call trace including rds_ib_post_reg_frmr, rds_ib_map_frmr, rds_ib_reg_frmr, rds_ib_get_mr, __rds_rdma_map, rds_cmsg_rdma_map, and rds_sendmsg in /var/log/kern.log or dmesg output.
• Process: Unexpected process calling sendmsg() with RDS_CMSG_RDMA_MAP on an RDS socket before an InfiniBand connection is established.
• System: Sudden system reboot or kernel panic on hosts with InfiniBand hardware and the rds or rds_rdma kernel modules loaded (GitHub Advisory).

Apply the upstream kernel patches available for all affected stable branches via the kernel stable tree (commits 23e07c340c44, 450ec93c0f17, 47de5b73db3b, 6b0a8de67ac0, 82e4a3b56b23, a54ecccfae62, a5bfd14c9a29, c506456ebf84). Fixed versions include 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, and 6.19.12. Distribution-specific patches have been issued by SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:21834-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1) and Debian. As a workaround, disable the rds kernel module (modprobe -r rds) on systems that do not require RDS over InfiniBand, and restrict RDS socket creation to trusted users via security policies (GitHub Advisory, Red Hat Bugzilla).