CVE-2026-80625

A flaw was found in the Linux kernel's RDMA/hns component. During concurrent driver removal and reset operations, bonding resources are incorrectly released and then re-allocated, leading to a memory leak. This memory leak can potentially cause a kernel panic, resulting in a Denial of Service (DoS) for the affected system.

A moderate-impact flaw was found in the Linux kernel's RDMA/hns (HiSilicon RoCE) driver. In a corner case of concurrent driver removal and driver reset, bonding resources are first released in hns_roce_hw_v2_exit() during driver removal and then allocated again in hns_roce_register_device() during driver reset. Because the release timing has already passed, this results in a memory leak, and the leaked notifier callback may also cause a kernel panic, resulting in a denial of service. Exploiting this flaw requires local access to the affected system. Red Hat Enterprise Linux (including the kernel and kernel-rt components across supported releases) and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable code is not present in the shipped kernel versions, so no update is required for Red Hat products. Upstream resolved the issue by inverting the teardown order of the bonding resources so that they are released when the driver is removed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.