EUVD-2026-93332

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPERUP after multicast flush ipoibibdevflushlight temporarily clears IPOIBFLAGOPERUP to prevent multicast joins while ipoibmcastdevflush is running, and restores the flag afterwards if it was previously...

CVE-2026-98347

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPERUP after multicast flush ipoibibdevflushlight temporarily clears IPOIBFLAGOPERUP to prevent multicast joins while ipoibmcastdevflush is running, and restores the flag afterwards if it was previously...

CVE-2026-98347

The Linux kernel contains a race condition in the IB/IPoIB driver where ipoib_ib_dev_flush_light() restores the IPOIB_FLAG_OPER_UP flag after a multicast flush. This restore can conflict with ipoib_ib_dev_down(), potentially leaving the flag set after the device is down. Consequently, ipoib_mcast...

CVE-2026-98257

The Linux kernel contains a vulnerability in the RDS over InfiniBand implementation. When a peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION, the rds_ib_cm_connect_complete() handler calls rds_conn_destroy() while holding the conn->c_cm_lock. This triggers a synchronou...

EUVD-2026-93185

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98257 rds: ib: use rds_conn_drop() on protocol version mismatch

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98257

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98257 rds: ib: use rds_conn_drop() on protocol version mismatch

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98217 IB/mlx4: Fix use-after-free on pkey sysfs registration failure

In the Linux kernel, the following vulnerability has been resolved: IB/mlx4: Fix use-after-free on pkey sysfs registration failure registerpkeytree ignores errors from registeronepkeytree and continues registering the remaining slaves. The per-slave error path has already released the pkey parent...

CVE-2026-98217 IB/mlx4: Fix use-after-free on pkey sysfs registration failure

In the Linux kernel, the following vulnerability has been resolved: IB/mlx4: Fix use-after-free on pkey sysfs registration failure registerpkeytree ignores errors from registeronepkeytree and continues registering the remaining slaves. The per-slave error path has already released the pkey parent...

EUVD-2026-93145

In the Linux kernel, the following vulnerability has been resolved: IB/mlx4: Fix use-after-free on pkey sysfs registration failure registerpkeytree ignores errors from registeronepkeytree and continues registering the remaining slaves. The per-slave error path has already released the pkey parent...

CVE-2026-98217

In the Linux kernel, the following vulnerability has been resolved: IB/mlx4: Fix use-after-free on pkey sysfs registration failure registerpkeytree ignores errors from registeronepkeytree and continues registering the remaining slaves. The per-slave error path has already released the pkey parent...

CVE-2026-98217

The Linux kernel contains a use-after-free vulnerability in the IB/mlx4 driver during pkey sysfs registration . The root cause is that the register_pkey_tree() function ignores errors from register_one_pkey_tree() and continues registering remaining slaves. While the error path releases the pkey ...

CVE-2026-98216 IB/hfi1: Fix the PIO_CRED credit-return mmap

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

CVE-2026-98216 IB/hfi1: Fix the PIO_CRED credit-return mmap

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

CVE-2026-98216

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

CVE-2026-98216

The Linux kernel is vulnerable to an issue within the IB/hfi1 driver during the PIO_CRED credit-return mmap operation. The root cause involves two errors in hfi1_file_mmap(): first, cr_page_offset is incorrectly treated as pointer arithmetic, causing memvirt to land outside the allocated range, w...

PT-2026-106695

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/rxe component where the rxe rereg user mr function reassigns the mr-ibmr.pd variable before validating the IB MR REREG ACCESS argument. If the access check...

CVE-2026-98358: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

CVE-2026-98216: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...