CVE-2026-92525: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate numsge/cursge before indexing wqe-dma.sge For a user QP, qp-sq.queue is a ring the application writes directly, so rxepostsend takes the isuser branch and only schedules sendtask without validating the WQE...

CVE-2026-93151: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is to...

CVE-2026-93153: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bngre: return a timeout when firmware responses stall waitforresp documents that it returns a non-zero error when a firmware command does not complete, and bngrercfwsendmessage already marks the firmware as stalled when the...

CVE-2026-93110: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloading ibcore putgidndev is queued with callrcu and implemented in ibcore. Stopping the workqueues does not drain callbacks already queued, so RCU could invoke it after the module code...

CVE-2026-93108: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93104: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvtallocdevice deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as val...

CVE-2026-93102: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1initdd allocates the shared AIP/VNIC RX support before returning. If hfi1init or hfi1registeribdevice later fails, initone tears down the device data without calling hfi1freerx...

CVE-2026-93107: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state When docomplete finds the QP in the error state it returns RESPSTCHKRESOURCE. Before commit 49dc9c1f0c7e "RDMA/rxe: Cleanup reset state handling ...

CVE-2026-93103: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Preserve unit 0 on allocation failure hfi1freedevdata assumes that the device was inserted into the unit table and unconditionally erases dd-unit. If xaallocirq fails, the zero-initialized unit remains zero, so full...

CVE-2026-90423: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxeodpmrinituser stores &umemodp-umem in mr-umem before calling rxeodpinitpages. If rxeodpinitpages fails, rxeodpmrinituser releases umemodp and returns an error. rxeregusermr the...

CVE-2026-90218: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in restort syzbot reported a WARNON!res-dev in restort triggered via addrhandler during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at restort+0x1c4/0x230 CPU1:...

CVE-2026-90416: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix stack out-of-bounds read in ccparams debugfs getparam reads a congestion parameter as a u32 but formats it with the signed "%d" into an 11-byte stack buffer. A value with bit 31 set, such as 0x80000000, renders as...

CVE-2026-90417: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Fix deregskb leak and double free in writetptentry When the device is in the fatal error state, writetptentry returns -EIO before handing the caller's preallocated skb to the transmit path; its allocation-failure...

CVE-2026-90415: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails writetptentry allocates a new STAG index with c4iwgetresource and bumps stats.stag.cur before programming the entry. When writeadaptermem fails, it returns the error without...

CVE-2026-90308: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM paths load QPs from dev-qpxa and then use or reference them outside the xarray lock. erdmadestroyqp can drop the destroy-path reference and...

CVE-2026-90307: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

CVE-2026-90309: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev-cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq can erase the CQ from the xarray and free its queu...

PT-2026-94822

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/erdma component. The CEQ interrupt handler schedules eqc-tasklet, which executes the erdma ceq completion handler function to read the...

CVE-2026-90219: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

CVE-2026-92523: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The top-level policy validates only the container, so it does not...