{"schema_version":"1.9.0","id":"CVE-2026-64281","published":"2026-07-25T08:49:24.399Z","modified":"2026-08-18T03:31:12.302721156Z","related":["openSUSE-SU-2026:11476-1"],"summary":"svcrdma: wake sq waiters when the transport closes","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: wake sq waiters when the transport closes\n\nThreads parked in svc_rdma_sq_wait() on sc_sq_ticket_wait or\nsc_send_wait can hang indefinitely in TASK_UNINTERRUPTIBLE state\nacross transport teardown, pinning svc_xprt references and\nblocking svc_rdma_free().\n\nThe close path sets XPT_CLOSE before invoking xpo_detach and both\nwait_event predicates include an XPT_CLOSE term, but the\npredicates are re-evaluated only on wakeup. sc_sq_ticket_wait has\nno completion-driven wake path; it is advanced solely by the\nchained ticket handoff inside svc_rdma_sq_wait() itself. Without\nan explicit wake at close, parked threads never observe\nXPT_CLOSE, hold their svc_xprt_get reference forever, and\nsvc_rdma_free() blocks on xpt_ref dropping to zero.\n\nTwo close entry points reach this transport. Local teardown runs\nsvc_rdma_detach() from svc_handle_xprt() -> svc_delete_xprt() ->\nxpo_detach() on a worker thread. A remote disconnect arrives at\nsvc_rdma_cma_handler(), which calls svc_xprt_deferred_close():\nthat sets XPT_CLOSE and enqueues the transport but does not\naccess either RDMA waitqueue, so a worker already parked in\nsvc_rdma_sq_wait() never re-evaluates its predicate. With every\nworker parked on this transport, no thread is available to run\nthe local teardown either, and the wake site there is\nunreachable.\n\nIntroduce svc_rdma_xprt_deferred_close(), a thin svcrdma wrapper\nthat calls svc_xprt_deferred_close() and then wakes both\nsc_sq_ticket_wait and sc_send_wait. Convert the svcrdma producers\nthat called svc_xprt_deferred_close() directly:\nsvc_rdma_cma_handler(), qp_event_handler(),\nsvc_rdma_post_send_err(), svc_rdma_wc_send(), the sendto drop\npath, the rw completion error paths, and the recvfrom flush and\nread-list error paths.\n\nWake both waitqueues from svc_rdma_detach() as well. The\nsynchronous svc_xprt_close() path (backchannel ENOTCONN, device\nremoval via svc_rdma_xprt_done) reaches detach without flowing\nthrough svc_xprt_deferred_close() and therefore does not invoke\nthe new helper.\n\n[ cel: add svc_rdma_xprt_deferred_close() to complete the fix ]","affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"ccc89b9d1ed233349cfe8d87b842e7351b74d8de"},{"fixed":"40eedc4253dbda0b29b7961200534dfcecb48ace"},{"fixed":"e5248a7426030db1e126363f72afdb3b71339a5c"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64281.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64281.json"}}],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/40eedc4253dbda0b29b7961200534dfcecb48ace"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e5248a7426030db1e126363f72afdb3b71339a5c"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64281.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64281"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64281.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}