CVE-2026-72491: net/9p: fix race condition on rdma->state in trans_rdma.c

CVE-2026-72491: net/9p: fix race condition on rdma->state in trans_rdma.c

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/9p: fix race condition on rdma->state in trans_rdma.c

The rdma->state field is modified without holding req_lock in both
recv_done() and p9_cm_event_handler(), while rdma_request() accesses
the same field under the req_lock spinlock. This inconsistent locking
creates a race condition:

- recv_done() running in softirq completion context sets
  rdma->state = P9_RDMA_FLUSHING without acquiring req_lock

- p9_cm_event_handler() modifies rdma->state at multiple points
  (ADDR_RESOLVED, ROUTE_RESOLVED, ESTABLISHED, CLOSED) without
  req_lock

- rdma_request() uses spin_lock_irqsave(&rdma->req_lock, flags) to
  protect the read-modify-write of rdma->state

The race can cause lost state transitions: recv_done() or the CM
event handler could set state to FLUSHING/CLOSED while rdma_request()
is concurrently checking or modifying state under the lock, leading to
the FLUSHING transition being silently overwritten by CLOSING. This
corrupts the connection state machine and can cause use-after-free on
RDMA request objects during teardown.

Fix by adding req_lock protection to all rdma->state modifications in
recv_done() and p9_cm_event_handler(), matching the pattern already
used in rdma_request(). Use spin_lock_irqsave/spin_unlock_irqrestore
in the CM event handler since it can race with recv_done() which runs
in softirq context.

Tested with a kernel module that races two threads (simulating
rdma_request and recv_done/CM handler) on rdma->state with proper
locking: 5.5M+ FLUSHING writes over 27M iterations with 0 lost
transitions.

The Linux kernel CVE team has assigned CVE-2026-72491 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.20 with commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b and fixed in 5.10.261 with commit 4cee2b8766045059d5e0b8114837b4a8efe827ac
	Issue introduced in 4.20 with commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b and fixed in 5.15.212 with commit 5424138848eb7d7d8a7196676e90a2cbf2142454
	Issue introduced in 4.20 with commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b and fixed in 6.1.178 with commit 3970a19a80de530b801b6256354d4a529a9a2d6c
	Issue introduced in 4.20 with commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b and fixed in 6.6.145 with commit 8aadc136d8e8d8fc95d7982d213cfe2234dfcf2b
	Issue introduced in 4.20 with commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b and fixed in 6.12.97 with commit 151f8cf5b23d8a534d884432a82a6d54d5a61989
	Issue introduced in 4.20 with commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b and fixed in 6.18.40 with commit 13bf9879b778b2f4b260b45bed18f31806120d1e
	Issue introduced in 4.20 with commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b and fixed in 7.1.5 with commit ebbcbe5c0db215feecc17def06178da443f4eea6
	Issue introduced in 4.20 with commit 473c7dd1d7b59ff8f88a5154737e3eac78a96e5b and fixed in 7.2-rc1 with commit 7d54894a1ee265a72d70f7cae1da6cc774cccc71
	Issue introduced in 4.4.185 with commit 3479b3c35e82ed10aa0ca2ee9e78c4eded06ba62
	Issue introduced in 4.9.185 with commit c01ddaa54d7411e964ffd250c018d8469c5852f2
	Issue introduced in 4.14.132 with commit 9e69c673fe077b8dc491cd8406c9bdcb1f76dee2
	Issue introduced in 4.19.57 with commit e48e7e27e4dfd00c81e0381e7cee610cce021452

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72491
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/9p/trans_rdma.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4cee2b8766045059d5e0b8114837b4a8efe827ac
	https://git.kernel.org/stable/c/5424138848eb7d7d8a7196676e90a2cbf2142454
	https://git.kernel.org/stable/c/3970a19a80de530b801b6256354d4a529a9a2d6c
	https://git.kernel.org/stable/c/8aadc136d8e8d8fc95d7982d213cfe2234dfcf2b
	https://git.kernel.org/stable/c/151f8cf5b23d8a534d884432a82a6d54d5a61989
	https://git.kernel.org/stable/c/13bf9879b778b2f4b260b45bed18f31806120d1e
	https://git.kernel.org/stable/c/ebbcbe5c0db215feecc17def06178da443f4eea6
	https://git.kernel.org/stable/c/7d54894a1ee265a72d70f7cae1da6cc774cccc71