CVE-2026-43469
Race Condition in Linux Kernel xprtrdma Module
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | 6.19.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's xprtrdma component. It occurs when the function rpcrdma_post_recvs() fails to create a work request, for example due to memory allocation failure, or exits early without decrementing the re_receiving counter. Because re_receiving is not decremented, the system hangs in the rpcrdma_xprt_drain() function as it waits for re_receiving to reach zero, which never happens. This leads to a hung task situation where certain kernel worker threads become blocked indefinitely.
How can this vulnerability impact me? :
The impact of this vulnerability is that on systems experiencing high memory pressure, kernel worker threads can become blocked for extended periods, causing system hangs or degraded performance. This can affect system stability and responsiveness, potentially disrupting services that rely on the Linux kernel's networking and remote direct memory access (RDMA) functionality.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can manifest as a hung task in the Linux kernel, specifically a blocked kworker thread related to the xprtrdma and rpcrdma subsystems.
You can detect it by looking for hung tasks with messages similar to the following in your system logs or dmesg output:
- INFO: task kworker/u385:17:8393 blocked for more than 122 seconds.
- Workqueue: xprtiod xprt_autoclose [sunrpc]
To investigate, you can use commands such as:
- dmesg | grep 'blocked for more than'
- ps -eo pid,comm,state,wchan | grep kworker
- cat /proc/sys/kernel/hung_task_timeout_secs (to check or adjust hung task timeout)
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves addressing the hung task caused by the decrement issue in the xprtrdma subsystem.
One temporary step is to disable the hung task timeout message by running:
- echo 0 > /proc/sys/kernel/hung_task_timeout_secs
However, this only suppresses the symptom and does not fix the underlying issue.
The proper mitigation is to update the Linux kernel to a version where this vulnerability is resolved, as the issue occurs when rpcrdma_post_recvs() fails to decrement re_receiving on early exit paths.