In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix listener leak in rdmacmalistenonall() failure If cmalistenonall() fails it leaves the per-device ID still on the listenlist but the state is not set to RDMACMADDRBOUND. When the cmid is eventually destroyed cmacancellistens() is not called due to the wrong state, however the per-device IDs are still holding the refcount preventing the ID from being destroyed, thus deadlocking: task:rping state:D stack: 0 pid:19605 ppid: 47036 flags:0x00000084 Call Trace: _schedule+0x29a/0x780 ? freeunrefpagecommit+0x9b/0x110 schedule+0x3c/0xa0 scheduletimeout+0x215/0x2b0 ? _flushwork+0x19e/0x1e0 waitforcompletion+0x8d/0xf0 destroyid+0x144/0x210 [rdmacm] ucmacloseid+0x2b/0x40 [rdmaucm] _destroyid+0x93/0x2c0 [rdmaucm] ? _xaerase+0x4a/0xa0 ucmadestroyid+0x9a/0x120 [rdmaucm] ucmawrite+0xb8/0x130 [rdmaucm] vfswrite+0xb4/0x250 ksyswrite+0xb5/0xd0 ? syscalltraceenter.isra.19+0x123/0x190 dosyscall64+0x33/0x40 entrySYSCALL64afterhwframe+0x44/0xa9 Ensure that cmalistenon_all() atomically unwinds its action under the lock during error.