CVE-2026-93153

CVE-2026-93153 affects the Linux kernel in the RDMA/bng_re subsystem. The root cause is that __wait_for_resp() ignores wait_event_timeout() expiry: if the response slot remains in use after the timeout and after the polled CREQ service attempt, the loop starts another full timeout period and can ...

CVE-2026-93153 RDMA/bng_re: return a timeout when firmware responses stall

In the Linux kernel, the following vulnerability has been resolved: RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and bngrercfwsendmessage already marks the firmware as stalled when the...

EUVD-2026-82261

In the Linux kernel, the following vulnerability has been resolved: RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and bngrercfwsendmessage already marks the firmware as stalled when the...

EUVD-2026-82259

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

CVE-2026-93151

CVE-2026-93151 is a memory leak in the Linux kernel's nvmet-rdma module. When an NVMe target using the RDMA transport is removed while I/Os are in flight, posted responses never receive their send completions before the connection is torn down, causing RDMA read/write contexts and request SGLs to...

CVE-2026-93151 nvmet-rdma: fix response resource leak on queue teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

CVE-2026-93151 nvmet-rdma: fix response resource leak on queue teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

EUVD-2026-82218

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloading ibcore putgidndev is queued with callrcu and implemented in ibcore. Stopping the workqueues does not drain callbacks already queued, so RCU could invoke it after the module code...

CVE-2026-93110 RDMA/core: Wait for RCU callbacks before unloading ib_core

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloading ibcore putgidndev is queued with callrcu and implemented in ibcore. Stopping the workqueues does not drain callbacks already queued, so RCU could invoke it after the module code...

EUVD-2026-82217

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

CVE-2026-93110

CVE-2026-93110 affects the Linux kernel 's RDMA/core subsystem, specifically the ib_core module. The vulnerability arises because put_gid_ndev() is queued via call_rcu(), but stopping workqueues during module unload does not drain already-queued RCU callbacks. Since synchronize_rcu() does not wai...

CVE-2026-93109 RDMA/mlx5: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

EUVD-2026-82216

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

EUVD-2026-82215

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93107

CVE-2026-93107 affects the Linux kernel RDMA/rxe (Soft-RoCE) subsystem. The root cause is a regression from commit 49dc9c1f0c7e, which removed the error-state branch from check_resource() but retained the error-state return in do_complete(). When a QP enters the error state while a packet is bein...

CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93107 RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93104

CVE-2026-93104 is a use-after-free in the Linux kernel 's RDMA/rvt subsystem. The function rvt_alloc_device() deallocates the IB device when its port array allocation fails, but then returns the pointer to the already-freed allocation. Callers treat any non-NULL return value as valid and derefere...

CVE-2026-93104 RDMA/rvt: Return NULL after port allocation failure

In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvtallocdevice deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as val...