Linux Distros Unpatched Vulnerability : CVE-2026-80864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rxe: Fix responder UAF on IBQPMAXDESTRDATOMIC modifyqp rxeqpfromattr handles IBQPMAXDESTRDATOMIC outside the IBQPSTATE path, so it holds no statelock and...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Initialize freeqp completion before using it. In irdmacreateqp, if ibcopytoudata fails, it will call irdmadestroyqp to clean up. This process will attempt to wait for the completion of freeqp, but freeqp has not yet...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fixed an error in the unwind operation of rxecreateqp. In the function rxecreateqp, the rxeqpfrominit function is called to initialize the qp. Internally, things like the spin locks are not set up until rxeqpinitreq is...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/rxe: Clear all QP fields if creation failed rxeqpdocleanup relies on valid pointer values in QP for the properly created ones. However, if rxeqpfrominit fails, the QP fields may be filled with garbage, causing the followi...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/mlx5: Returns the firmware result upon destroying QP/RQ Previously, when destroying a QP/RQ, the result of the firmware destruction function was ignored, and the upper layers were not informed of the failure. This could...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/irdma: Fixed a data race on the CQP request done field. KCSAN detected a data race in the cqprequest-requestdone memory location. This location is accessed without a lock in the irdmahandlecqpop function, while it was bei...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fixed the use-after-free of rsvqp on HIP08. Currently, rsvqp is freed before the ibunregisterdevice function is called on HIP08. During this time interval, users can still deregister MR, and rsvqp will be used in this...

CVE-2026-68418

A flaw was found in the RDMA/irdma component of the Linux kernel. A local user could exploit this vulnerability by providing a zero value for userwqebufs during the creation of a Queue Pair QP. This action leads to a null pointer dereference, which can cause the system to crash, resulting in a...

CVE-2026-68417

A flaw was found in the Linux kernel's RDMA/siw component. The siwcreateqp function prematurely publishes a Queue Pair QP before its complete initialization. This allows a Queue Pair Number QPN lookup to access a QP that is still under construction, potentially leading to unexpected behavior or...

CVE-2026-68418

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...

CVE-2026-68417

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siwcreateqp currently calls siwqpadd before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being...

EUVD-2026-55604

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...

CVE-2026-68418

CVE-2026-68418 affects the Linux kernel RDMA/irdma path, specifically QP creation. The root cause was that iwqp->iwpbl could be dereferenced unconditionally later in irdma_setup_virt_qp if a user supplied req.user_wqe_bufs, even when it was zero. Although there was a NULL check, it only applie...

CVE-2026-68418 RDMA/irdma: Prevent user-triggered null deref on QP create

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp-iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp-iwpbl is...

CVE-2026-68417

The CVE-2026-68417 issue affects the Linux kernel RDMA/siw component. Root cause: siw_create_qp() calls siw_qp_add() before QP state/queues/CQs/completion/device list are fully initialized, allowing a QPN lookup to reach a QP still under construction. The remediation implemented in the public des...

CVE-2026-68417 RDMA/siw: publish QP after initialization

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siwcreateqp currently calls siwqpadd before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/rxe: Fixed a race condition in QP timer handlers. The following warning was encountered: WARNING: drivers/infiniband/sw/rxe/rxetask.c:249 at rxeschedtask+0x1c8/0x238 rdmarxe, CPU0: swapper/0/0 … libsha1 last unloaded:...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: RDMA/mana: The user-triggered WARNON function was removed from manaibcreateqprss. Sashiko points out that users can specify Work Quotas WQs that share the same Channel Queue CQ as part of the uAPI. This can trigger the WARNON...

CVE-2026-46265

A flaw was found in the Linux kernel's RDMA/hns component. When the sunrpc Sun Remote Procedure Call is in use and a reset is triggered, a workqueue dependency issue can occur during Queue Pair QP destruction. This can lead to a kernel warning related to memory reclaim, potentially causing system...

CVE-2026-46265 RDMA/hns: Fix WQ_MEM_RECLAIM warning

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQMEMRECLAIM warning When sunrpc is used, if a reset triggered, our wq may lead the following trace: workqueue: WQMEMRECLAIM xprtiod:xprtrdmaconnectworker rpcrdma is flushing !WQMEMRECLAIM...