CVE-2026-64281

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: wake sq waiters when the transport closes

Threads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or

sc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state

across transport teardown, pinning svc_xprt references and

blocking svc_rdma_free().

The close path sets XPT_CLOSE before invoking xpo_detach and both

wait_event predicates include an XPT_CLOSE term, but the

predicates are re-evaluated only on wakeup. sc_sq_ticket_wait has

no completion-driven wake path; it is advanced solely by the

chained ticket handoff inside svc_rdma_sq_wait() itself. Without

an explicit wake at close, parked threads never observe

XPT_CLOSE, hold their svc_xprt_get reference forever, and

svc_rdma_free() blocks on xpt_ref dropping to zero.

Two close entry points reach this transport. Local teardown runs

svc_rdma_detach() from svc_handle_xprt() -> svc_delete_xprt() ->

xpo_detach() on a worker thread. A remote disconnect ar

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References