CVE-2026-99166

In the Linux kernel, the following vulnerability has been resolved:

net: rds: fix uninitialized trans dereference in CM event handler

rds rdma cm event handler cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA NODE IB CA). On any other device type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but the event switch dereferences it: unconditionally in the RDMA CM EVENT CONNECT REQUEST case via trans->cm handle connect(), and (with a connection context) in the ROUTE RESOLVED and ESTABLISHED cases.

An RDS listener on an iWARP device therefore crashes the kernel as soon as a connect request arrives: with CONFIG INIT STACK ALL ZERO the wild load becomes a NULL dereference at offset 0xa0 (&trans->cm handle connect) in the iw cm wq workqueue.

GCC masks the bug in default builds by folding the uninitialized load into &rds ib transport; Clang-built kernels take the real uninitialized path and oops.

The active side can land on a non-IB device too: the id that rds ib conn path connect() creates is not restricted to a node type, so rdma resolve addr() binds it to whichever device serves the local address, and an iWARP RNIC on the same netdev qualifies. The crash there is different: resolving a route on an iWARP id never fills in cm id->route.path rec, and the ROUTE RESOLVED case writes path rec[0].sl before it calls into the transport.

The iWARP transport was dropped long ago and IB is the only transport left, so make that explicit: initialize trans to &rds ib transport at declaration, drop the conditional assignment, reject a connect request that arrives on a non-IB device, and drop a connection whose address resolved to one instead of resolving a route on it. The rejection is limited to RDMA CM EVENT CONNECT REQUEST on purpose: a non-zero return from the handler makes rdma cm destroy the id the event was delivered on, which is right for the request's freshly created id but would free a connection id that RDS still owns for any other event. On the active side the id stays ic->i cm id and the connection's shutdown destroys it, so that case returns 0.

[achender: reject only on RDMA CM EVENT CONNECT REQUEST instead of bailing out for every event on a non-IB device, so that rdma cm does not destroy connection ids RDS still tracks; drop a connection whose address resolved to a non-IB device before a route is resolved on it; changelog adjusted]