CVE-2014-2739 in Linux
Summary
by MITRE
The cma_req_handler function in drivers/infiniband/core/cma.c in the Linux kernel 3.14.x through 3.14.1 attempts to resolve an RDMA over Converged Ethernet (aka RoCE) address that is properly resolved within a different module, which allows remote attackers to cause a denial of service (incorrect pointer dereference and system crash) via crafted network traffic.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/10/2026
The vulnerability identified as CVE-2014-2739 resides within the Linux kernel's Infiniband core subsystem, specifically in the cma_req_handler function located in drivers/infiniband/core/cma.c. This flaw affects Linux kernel versions 3.14.x through 3.14.1, representing a critical issue that exploits improper address resolution handling within the RDMA over Converged Ethernet protocol implementation. The vulnerability manifests when the kernel attempts to resolve RDMA addresses that have already been properly resolved by another module, creating a scenario where incorrect pointer dereferences occur during network packet processing.
The technical exploitation of this vulnerability occurs through crafted network traffic that triggers the flawed address resolution logic in the cma_req_handler function. When remote attackers send specially constructed packets, the kernel's Infiniband communication manager attempts to process these packets through the problematic code path where it incorrectly handles address resolution that should have been completed by a different kernel module. This creates a condition where the kernel dereferences invalid memory pointers, leading to system crashes and complete denial of service for the affected system. The flaw operates at the kernel level and does not require local privileges, making it particularly dangerous as any remote attacker with network access can potentially trigger the vulnerability.
The operational impact of this vulnerability extends beyond simple system crashes, as it represents a fundamental failure in kernel memory management and address resolution protocols. Systems running affected kernel versions become susceptible to remote exploitation, potentially allowing attackers to disrupt critical network services that depend on Infiniband connectivity for high-performance computing environments. This vulnerability directly impacts data center infrastructure, high-performance computing clusters, and any networked systems that utilize RDMA technology for low-latency, high-throughput communications. The attack surface is particularly concerning for enterprise environments where such systems are deployed for mission-critical applications requiring reliable network connectivity.
Mitigation strategies for this vulnerability require immediate kernel updates to versions that contain the appropriate patches addressing the incorrect pointer dereference issue. Organizations should prioritize applying the security patches released by kernel maintainers and ensure that all systems running affected kernel versions are updated promptly. Additionally, network administrators should implement monitoring solutions to detect unusual network traffic patterns that might indicate exploitation attempts, while also considering network segmentation to limit potential attack vectors. The vulnerability aligns with CWE-476 which describes null pointer dereference conditions, and represents a specific implementation flaw that could be categorized under ATT&CK technique T1499 for network denial of service attacks targeting system resources. Organizations should also conduct thorough vulnerability assessments to identify systems running affected kernel versions and ensure comprehensive patch management processes are in place to prevent similar issues in the future.