CVE-2026-52939

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the rds ib send cqe handler() function when handling masked atomic completions. The rds ib xmit atomic() function programs a masked atomic opcode (either IB WR MASKED ATOMIC CMP AND SWP or IB WR MASKED ATOMIC FETCH AND ADD) for every RDS atomic cmsg. However, the completion-side switch in rds ib send unmap op() only handles non-masked opcodes, causing masked atomic completions to fall through to a default state that returns a NULL value for the rm variable while send->s op remains set. This leads to a crash in the softirq context when rds ib send cqe handler() dereferences rm->m final op. An unprivileged user can trigger this issue by using sendmsg() for an atomic cmsg over an active RDS/IB connection, particularly on hardware that natively supports masked atomics, such as mlx4 and mlx5.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.