PT-2026-94898

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA hfi1 driver where the hfi1 init dd function allocates shared AIP/VNIC RX support. If the hfi1 init or hfi1 register ib device functions subsequently fail, the...

PT-2026-94763

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/cxgb4 driver where the write tpt entry function fails to release a STAG index when write adapter mem returns an error. The function allocates a new STAG index...

CVE-2026-93104: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvtallocdevice deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as val...

CVE-2026-93037: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdmatxinitahg errors settxreqheaderahg ignores the return value of sdmatxinitahg. If sdmatxinitahg fails, it returns before initializing tx-txreq. However, settxreqheaderahg ignores the error and returns the...

CVE-2026-92507: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibdeallocpduser When accessing a PD via the netlink path the only synchronization mechanism for the said PD is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of...

CVE-2026-92514: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Fix CEQ tasklet use-after-free on removal Each CEQ interrupt handler only schedules eqc-tasklet. The tasklet calls erdmaceqcompletionhandler, which reads the DMA-coherent EQ ring through getnextvalideqe and updates...

CVE-2026-92488: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdmadestroyqp, erdmadestroycq, erdmaderegmr, and erdmadestroyah returned early when erdmapostcmdwait failed, leaking the queue buffers, MTTs, doorbells and the...

CVE-2026-92495: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Clear VMMAYWRITE on DBR/toggle page mmap bnxtremmap rejects VMWRITE for the DBRPAGE and TOGGLEPAGE mmap flags, but a read-only mapping can still retain VMMAYWRITE. nd later be upgraded with mprotectPROTWRITE. This ca...

CVE-2026-92512: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix use after free in ibqueryqp When querying a QP via the netlink flow the only synchronization mechanism for the said QP is rdmarestrackget, meanwhile during the QP destroy path rdmarestrackdel is called at the end o...

CVE-2026-93151: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

CVE-2026-93154: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Add refcounting to user ring MRs Prevent userspace from deregistering the MRs that back QP/CQ/SRQ rings by bumping the MR's refcount upon association...

ALSA-2026:68570 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel t7xx WWAN driver: Denial of Service via buffer overflow CVE-2026-23172 kernel: xfrm: hold dev ref until after transportfinish NFHOOK CVE-2026-31663 kernel: RDMA/rxe: Fix race...

CVE-2026-90309: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev-cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq can erase the CQ from the xarray and free its queu...

PT-2026-94640

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/siw component within the siw accept function. The function looks up a Queue Pair QP provided by userspace; if the QP is already in Ready to Send...

Unbreakable Enterprise kernel security update

5.15.0-324.217.5.3 - net: tun: bound receive headroom Asim Viladi Oglu Manizada Orabug: 40035523 CVE-2026-81000 - xfrm: ah6: validate routing header segmentsleft Asim Viladi Oglu Manizada Orabug: 40035522 CVE-2026-80844 - tcp: clear sockops cb flags before force-closing a child socket Sechang Lim...

CVE-2026-90292: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siwaccept siwaccept looks up the QP supplied by userspace. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup tests whether...

CVE-2026-90417: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Fix deregskb leak and double free in writetptentry When the device is in the fatal error state, writetptentry returns -EIO before handing the caller's preallocated skb to the transmit path; its allocation-failure...

CVE-2026-93102: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

CVE-2026-90219: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

CVE-2026-92508: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in ibfreecq When accessing a CQ via the netlink path the only synchronization mechanism for the said CQ is rdmarestrackget. Currently, rdmarestrackdel is invoked at the end of ibfreecq, whi...