CVE-2026-52939

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

rds_ib_xmit_atomic() always programs a masked atomic opcode

(IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)

for every RDS atomic cmsg. But the completion-side switch in

rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked

atomic completion falls through to default and returns rm == NULL while

send->s_op is left set. rds_ib_send_cqe_handler() then dereferences the

NULL rm via rm->m_final_op, oopsing in softirq context. An unprivileged

AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection

triggers it; on hardware that natively accepts masked atomics (mlx4,

mlx5) no extra setup is needed.

RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!

Oops: general protection fault [#1] SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]

RIP: rds_ib_

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References