CVE-2026-80625 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix memory leak of bonding resources
In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hns_roce_hw_v2_exit() during driver removal, and then is allocated again in hns_roce_register_device() during driver reset. This leads to memory leak because the release timing has already passed. This may also lead to a kernel panic as below because of the leaked notifier callback:
Call trace: 0xffffa20fccc04978 (P) raw_notifier_call_chain+0x20/0x38 call_netdevice_notifiers_info+0x60/0xb8 netdev_lower_state_changed+0x4c/0xb8
As Sashiko suggested, the teardown order of bonding resources should be inverted to make sure the resources are released when the driver is removed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The Linux kernel vulnerability identified in the RDMA/hns subsystem involves a critical resource management flaw within the HNS RoCE hardware abstraction layer. This issue manifests specifically during concurrent operations involving driver removal and subsequent driver reset procedures. The core technical deficiency lies in the ordering of resource lifecycle events, where bonding resources are prematurely released before they can be safely re-initialized or managed by the system's internal state machines. Specifically, when a device is removed from the system, the function hns_roce_hw_v2_exit() executes and frees the associated bonding resources. However, if a driver reset occurs immediately following this removal phase, the subsequent call to hns_roce_register_device() attempts to allocate these same resources again. Because the release timing has already passed for the original allocation context, the system fails to properly track or clean up the newly allocated memory block, resulting in a persistent memory leak that accumulates over repeated reset cycles.
Beyond simple resource exhaustion, this improper handling of bonding resources introduces significant stability risks by triggering kernel panics due to dangling pointers within notifier callback chains. The leaked notifier callbacks remain registered with the network device subsystem even after their underlying data structures have been freed or invalidated. When network state changes occur, such as lower layer state transitions, the kernel invokes these stale callbacks via raw_notifier_call_chain and call_netdevice_notifiers_info. Since the memory backing these callbacks has already been released during the driver removal phase, accessing them results in invalid memory access operations. This leads to a crash trace involving netdev_lower_state_changed, demonstrating that the vulnerability compromises not only system stability but also the integrity of network device notification mechanisms essential for proper interface management and state synchronization within the kernel networking stack.
From a classification perspective, this flaw aligns with CWE-401, which describes missing release of memory after successful allocation, as well as CWE-362 regarding concurrent execution race conditions that lead to resource corruption or loss. The vulnerability also relates to improper lifecycle management often categorized under CWE-755 for improper handling of unusual input states where the system fails to handle edge cases like rapid removal and reset sequences correctly. In terms of attack vectors, while this is primarily a stability issue rather than an exploitable privilege escalation vector in most contexts, it can be leveraged by local attackers with access to device management interfaces to induce denial-of-service conditions through repeated driver resets or resource exhaustion attacks that degrade system performance over time until a crash occurs.
The recommended mitigation involves correcting the teardown order of bonding resources within the HNS RoCE driver implementation. As suggested by developer analysis, the release logic must be inverted so that resources are properly released only when appropriate during the final stages of device removal, ensuring they are not freed prematurely before reset operations can safely re-initialize them. This adjustment ensures that the lifecycle of bonding resources remains consistent across both normal operation and edge-case scenarios involving driver resets. Administrators should apply kernel updates containing this patch to prevent memory leaks and potential system crashes associated with RDMA hardware management in environments where frequent device removal or resetting is performed, thereby maintaining long-term stability and resource integrity for high-performance computing networks relying on RoCE technology.