Linux Kernel RDMA/EFA CVE-2026-31493

Exploitation requires authenticated local access with low privileges (PR:L) to a Linux system running kernel versions 5.12 through 7.0-rc7 with the RDMA Elastic Fabric Adapter driver loaded and active. The vulnerability is specific to systems with EFA hardware support-primarily AWS EC2 instances configured with Elastic Network Adapters in EFA mode for high-performance RDMA networking. Standard Linux installations without EFA driver compilation or AWS EFA-enabled instance types are not affected. The attacker must be able to interact with the RDMA subsystem to submit admin commands, typically requiring membership in system groups with RDMA device access permissions. Limiting exploitation are the need for sophisticated heap manipulation techniques to reliably control freed memory contents and convert the use-after-free into code execution, the local-only attack vector, and the relatively narrow deployment base of EFA-enabled systems compared to general Linux populations.

Despite the high CVSS base score of 7.8, real-world risk is substantially mitigated by multiple factors. The AV:L (local access) vector requires the attacker to already have authenticated shell access to the system, and PR:L indicates low-privilege requirements but not completely unprivileged exploitation. The EPSS score of 0.02% (4th percentile) suggests minimal observed exploitation activity, likely because successful exploitation requires both local access and specific RDMA/EFA hardware or cloud configurations (AWS Elastic Fabric Adapter). No CISA KEV listing indicates no confirmed active exploitation campaigns. The AC:L (low attack complexity) is somewhat misleading-while the technical use-after-free trigger may be straightforward, achieving reliable code execution through heap manipulation requires sophisticated exploitation techniques. Priority should be moderate for systems running RDMA workloads on AWS EFA-enabled instances, but low for general Linux deployments without this hardware. The primary risk is to HPC, machine learning, and high-performance networking environments using AWS infrastructure. Patches are available across all affected stable branches, making this primarily a patch management exercise rather than an emergency response scenario.

An attacker with low-privilege local shell access on an AWS EC2 instance using Elastic Fabric Adapter triggers the vulnerability by submitting a malformed RDMA admin command that causes an error condition during completion handling. The EFA driver's interrupt handler frees the completion context structure prematurely, then error-handling code attempts to print diagnostic data from the freed memory. The attacker simultaneously performs heap spraying to control the contents of the freed memory slot, replacing it with crafted data structures. When the error handler dereferences the freed context, it instead processes attacker-controlled pointers, leading to arbitrary kernel memory read/write primitives. The attacker leverages this to overwrite kernel function pointers or credential structures, escalating to root privileges and achieving full system compromise.