CVE-2026-98367

A vulnerability exists in the Linux kernel RDMA/siw component where a Use-After-Free (UAF) condition can occur. If siw_qp_modify() fails within siw_accept(), the state_lock is released before error path cleanup. This creates a race window where a concurrent ibv_modify_qp() call can transition the...

EUVD-2026-93352

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

EUVD-2026-93351

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

CVE-2026-98366

The Linux kernel RDMA/rxe driver contains a slab-use-after-free vulnerability in the rxe_rereg_user_mr() function. The root cause is that the driver reassigns the memory region's protection domain (mr->ibmr.pd ) before validating the IB_MR_REREG_ACCESS argument. If validation fails, the reassi...

CVE-2026-98365

A vulnerability exists in the Linux kernel RDMA/rxe driver where integer overflow in the mr_check_range() function allows for out-of-bounds (OOB) access . Because the function uses wraparound-prone arithmetic to validate the range of registered Memory Regions (MR), a remote peer can craft an RDMA...

EUVD-2026-93350

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

EUVD-2026-93346

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98361

The Linux kernel contains a vulnerability in the RDMA/rxe driver where the rxe_check_pagefault() function failed to perform access permission tests, retaining only the HMM_PFN_VALID check. This allowed ODP write operations, such as RDMA WRITE and SEND payloads, to modify read-only pages (e.g., pa...

CVE-2026-98360

The Linux kernel contains a vulnerability in the RDMA/rxe driver where a newly allocated multicast group (mcg) is published to the mcg_tree before the backing Ethernet multicast address is successfully programmed via rxe_mcast_add(). If rxe_mcast_add() fails (e.g., due to -ENODEV), the system fre...

EUVD-2026-93345

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

EUVD-2026-93344

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference...

CVE-2026-98359

The Linux kernel contains a vulnerability in the RDMA/core component. The function ib_get_eth_speed() fails to verify the registration state of a net_device before invoking its ethtool callback. This allows an asynchronous RDMA port query to potentially access a network device after NETDEV_UNREGI...

CVE-2026-98356

The Linux kernel contains a vulnerability in the RDMA/bnxt_re driver. Specifically, the function bnxt_re_init_dcb_wq() fails to properly handle a failed memory allocation. This oversight results in the asynchronous DCB handler subsequently calling queue_work() on a NULL pointer , which can lead t...

EUVD-2026-93341

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...

CVE-2026-98355

The Linux kernel contains a vulnerability in the RDMA/rtrs component where a null pointer dereference can occur. Specifically, if init_path() fails in the client, the cleanup function rtrs_clt_close_conns() may attempt to call event tracing code using clt_path->kobj->name while that name is...

EUVD-2026-93340

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...

CVE-2026-98354

A memory leak vulnerability exists in the Linux kernel within the RDMA/mad component. The issue occurs in ib_mad_complete_recv() because ib_mad_enforce_security() is executed before the recv_buf is linked to the rmpp_list. If security enforcement fails, the system calls ib_free_recv_mad(), which ...

EUVD-2026-93339

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...

EUVD-2026-93337

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDRRESOLVED handler via ibcqpoolget, before the peer is connected. createcm can return -ERESTARTSYS from...

CVE-2026-98352

The Linux kernel contains a vulnerability in the RDMA/rtrs-clt component where a CQ pool leak occurs when a connection is interrupted. The issue is caused by a race condition in the ADDR_RESOLVED handler: the client may borrow shared CQ credits via ib_cq_pool_get() before the peer is connected. I...