EUVD-2026-82129

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

CVE-2026-92508 RDMA/core: Fix potential use after free in ib_free_cq()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

CVE-2026-92508 RDMA/core: Fix potential use after free in ib_free_cq()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...

CVE-2026-92507

CVE-2026-92507 is a use-after-free vulnerability in the Linux kernel's RDMA/core subsystem, specifically in the ib_dealloc_pd_user() function. When a Protection Domain (PD) is accessed via the netlink path, the only synchronization mechanism is rdma_restrack_get(). The flaw is that rdma_restrack_...

CVE-2026-92507 RDMA/core: Fix potential use after free in ib_dealloc_pd_user()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

EUVD-2026-82128

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92507 RDMA/core: Fix potential use after free in ib_dealloc_pd_user()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92495 RDMA/bnxt_re: Clear VM_MAYWRITE on DBR/toggle page mmap

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap bnxtremmap rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotectPROTWRITE. This ca...

CVE-2026-92488

CVE-2026-92488 is a resource-leak vulnerability in the Linux kernel's RDMA/erdma subsystem. The destructor functions erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed, leaking queue buffers, MTTs, doorbells, and hardw...

CVE-2026-92488 RDMA/erdma: complete object teardown when the destroy command fails

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdmadestroyqp, erdmadestroycq, erdmaderegmr, and erdmadestroyah returned early when erdmapostcmdwait failed, leaking the queue buffers, MTTs, doorbells and the...

CVE-2026-90435 RDMA/mlx5: Fix integer overflow of user QP buffer size

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-90435

CVE-2026-90435 is an integer overflow vulnerability in the Linux kernel's RDMA/mlx5 subsystem. The function set_user_buf_size() left-shifts user-supplied rq.wqe_cnt and rq.wqe_shift values as signed integers ; a sufficiently large rq.wqe_cnt triggers signed integer overflow (undefined behavior), ...

CVE-2026-90435 RDMA/mlx5: Fix integer overflow of user QP buffer size

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix integer overflow of user QP buffer size setuserbufsize computes the QP buffer size by left-shifting the user-supplied rq.wqecnt and rq.wqeshift values as signed integers. A sufficiently large rq.wqecnt causes signe...

CVE-2026-90423

This Linux kernel vulnerability is a Use-After-Free (UAF) in the RDMA/rxe (Soft-RoCE) subsystem, specifically in the ODP (On-Demand Paging) initialization error-handling path. The root cause is that rxe_odp_mr_init_user() stores a pointer to the ODP umem in mr->umem before calling rxe_odp_init...

EUVD-2026-82084

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxeodpmrinituser stores &umemodp-umem in mr-umem before calling rxeodpinitpages. If rxeodpinitpages fails, rxeodpmrinituser releases umemodp and returns an error. rxeregusermr the...

CVE-2026-90423 RDMA/rxe: Fix UAF in ODP init error-handling path

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxeodpmrinituser stores &umemodp-umem in mr-umem before calling rxeodpinitpages. If rxeodpinitpages fails, rxeodpmrinituser releases umemodp and returns an error. rxeregusermr the...

CVE-2026-90417

This CVE affects the Linux kernel RDMA/cxgb4 driver (Chelsio cxgb4). The root cause is improper skb ownership in write_tpt_entry() : when the device is in a fatal error state or allocation fails, the function returns early without freeing the caller's preallocated skb. As a result, c4iw_dereg_mr(...

CVE-2026-90417 RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Fix deregskb leak and double free in writetptentry When the device is in the fatal error state, writetptentry returns -EIO before handing the caller's preallocated skb to the transmit path; its allocation-failure...

EUVD-2026-82077

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-90416

This stack out-of-bounds read affects the RDMA/mlx5 driver's cc_params debugfs interface in the Linux kernel . The root cause is a format-string mismatch: get_param() reads a congestion control parameter as a u32 but formats it with the signed "%d" specifier into an 11-byte stack buffer . When a ...