CVE-2026-64281

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Threads parked in the svc rdma sq wait() function on sc sq ticket wait or sc send wait can hang indefinitely in a TASK UNINTERRUPTIBLE state during transport teardown. This occurs because the close path sets the XPT CLOSE flag, but the predicates are only re-evaluated upon wakeup. Since sc sq ticket wait lacks a completion-driven wake path, parked threads may never observe the XPT CLOSE state, causing them to hold svc xprt get references indefinitely and blocking the svc rdma free() function. This issue can be triggered by local teardown via svc rdma detach() or remote disconnects arriving at svc rdma cma handler(), which calls svc xprt deferred close() without accessing the RDMA waitqueues.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.