CVE-2024-36476

RDMA/rtrs: Ensure 'ib_sge list' is accessible

MEDIUM

5.5

CVSS Score

Published: January 15, 2025 at 01:10 PM UTC

Updated: August 5, 2026 at 12:04 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the function. Previously, 'ib_sge list' was declared within the 'always_invalidate' block, limiting its accessibility, then caused a 'BUG: kernel NULL pointer dereference'[1]. ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2d0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? memcpy_orig+0xd5/0x140 rxe_mr_copy+0x1c3/0x200 [rdma_rxe] ? rxe_pool_get_index+0x4b/0x80 [rdma_rxe] copy_data+0xa5/0x230 [rdma_rxe] rxe_requester+0xd9b/0xf70 [rdma_rxe] ? finish_task_switch.isra.0+0x99/0x2e0 rxe_sender+0x13/0x40 [rdma_rxe] do_task+0x68/0x1e0 [rdma_rxe] process_one_work+0x177/0x330 worker_thread+0x252/0x390 ? __pfx_worker_thread+0x10/0x10 This change ensures the variable is available for subsequent operations that require it. [1] https://lore.kernel.org/linux-rdma/[email protected]/

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

5.11 ≤ v < 5.15.1765.16 ≤ v < 6.1.1245.8 ≤ v < 5.10.2335.8 ≤ v < 5.15.1765.8 ≤ v < 6.1.1245.8 ≤ v < 6.12.95.8 ≤ v < 6.135.8 ≤ v < 6.6.706.2 ≤ v < 6.6.706.7 ≤ v < 6.12.96.13 rc1 6.13 rc2 6.13 rc3 6.13 rc4 6.13 rc59cb837480424e78ed585376f944088246685aec3

Vendor states this is fixed in 143378075904e78b3b2a810099bcc3b3d82d762f (fixed)

Vendor states this is fixed in 32e1e748a85bd52b20b3857d80fd166d22fa455a (fixed)

Vendor states this is fixed in 6ffb5c1885195ae5211a12b4acd2d51843ca41b0 (fixed)

Vendor states this is fixed in 7eaa71f56a6f7ab87957213472dc6d4055862722 (fixed)

Vendor states this is fixed in b238f61cc394d5fef27b26d7d9aa383ebfddabb0 (fixed)

Vendor states this is fixed in fb514b31395946022f13a08e06a435f53cf9e8b3 (fixed)

Vendor states this is fixed in 5.10.233 (unaffected)

Vendor states this is fixed in 5.15.176 (unaffected)

Vendor states this is fixed in 5.8 (unaffected)

Vendor states this is fixed in 6.1.124 (unaffected)

Vendor states this is fixed in 6.12.9 (unaffected)

Vendor states this is fixed in 6.13 (unaffected)