CVE-2026-100075

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srptallocrwctxs unwind counters When srptallocrwctxs fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale nrwctx and nrdma values and a dangling rwctxs...

CVE-2026-97477

In the Linux kernel, the following vulnerability has been resolved: RDMA/counter: Fix numcounters leak on bindqp failure in allocandbind When rdmacounterbindqp fails in allocandbind, the error path jumps to errmode which frees the counter without decrementing portcounter-numcounters. The only pla...

CVE-2026-97421

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ibumemfindbestpgsz Several corner cases, especially important on 32 bits: - umem-iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the...

CVE-2026-97413

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-srv: Fix integer underflow in processread and processwrite usrlen is read from a network-supplied message field le16tocpu and used to compute datalen = off - usrlen without validating that usrlen off causing an integer...

CVE-2026-93277

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy...

CVE-2026-93267

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in uverbsfreedmah When accessing a dmah via the netlink path the only synchronization mechanism for the said dmah is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-93264

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL, if it's an indirect PBL we create a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size and can hold 510 addresses EFAPTRSPERCHUNK...