335644 matches found
CVE-2026-98357 IB/isert: wait for deferred control PDU completions before releasing the connection
In the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the connection isertsenddone hands ISTATESENDTASKMGTRSP, ISTATESENDREJECT and ISTATESENDTEXTRSP completions off to isertcompwq and returns. The work item then...
EUVD-2026-93342
In the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the connection isertsenddone hands ISTATESENDTASKMGTRSP, ISTATESENDREJECT and ISTATESENDTEXTRSP completions off to isertcompwq and returns. The work item then...
CVE-2026-98357
The Linux kernel contains a slab-use-after-free vulnerability within the IB/isert component. The issue arises because isert_send_done() offloads certain completions to isert_comp_wq, but there is no ordering to prevent these work items from running during a teardown. Specifically, isert_wait_conn...
EUVD-2026-93341
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...
CVE-2026-98356
The Linux kernel contains a vulnerability in the RDMA/bnxt_re driver. Specifically, the function bnxt_re_init_dcb_wq() fails to properly handle a failed memory allocation. This oversight results in the asynchronous DCB handler subsequently calling queue_work() on a NULL pointer , which can lead t...
CVE-2026-98356 RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...
CVE-2026-98355
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...
CVE-2026-98355
The Linux kernel contains a vulnerability in the RDMA/rtrs component where a null pointer dereference can occur. Specifically, if init_path() fails in the client, the cleanup function rtrs_clt_close_conns() may attempt to call event tracing code using clt_path->kobj->name while that name is...
CVE-2026-98355 RDMA/rtrs: guard against null kobj name
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...
EUVD-2026-93340
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...
CVE-2026-98355 RDMA/rtrs: guard against null kobj name
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...
EUVD-2026-93339
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...
CVE-2026-98354
A memory leak vulnerability exists in the Linux kernel within the RDMA/mad component. The issue occurs in ib_mad_complete_recv() because ib_mad_enforce_security() is executed before the recv_buf is linked to the rmpp_list. If security enforcement fails, the system calls ib_free_recv_mad(), which ...
CVE-2026-98354 RDMA/mad: Fix receive buffer leak when PKey enforcement fails
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...
CVE-2026-98354 RDMA/mad: Fix receive buffer leak when PKey enforcement fails
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...
CVE-2026-98352 RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDRRESOLVED handler via ibcqpoolget, before the peer is connected. createcm can return -ERESTARTSYS from...
CVE-2026-98352
The Linux kernel contains a vulnerability in the RDMA/rtrs-clt component where a CQ pool leak occurs when a connection is interrupted. The issue is caused by a race condition in the ADDR_RESOLVED handler: the client may borrow shared CQ credits via ib_cq_pool_get() before the peer is connected. I...
EUVD-2026-93338
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xalock, the look...
CVE-2026-98353
The Linux kernel contains a vulnerability in the RDMA/erdma subsystem where locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. This occurs because if an interrupt arrives while the create path holds a plain xa_lock , the lookup operation spins indefinitely a...
CVE-2026-98353 RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables Locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. If an interrupt arrives while the create path holds the plain xalock, the look...