CVE-2026-90415: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails writetptentry allocates a new STAG index with c4iwgetresource and bumps stats.stag.cur before programming the entry. When writeadaptermem fails, it returns the error without...

CVE-2026-90308: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold QP references for AE and CM processing AE QP fatal events and iWARP CM paths load QPs from dev-qpxa and then use or reference them outside the xarray lock. erdmadestroyqp can drop the destroy-path reference and...

CVE-2026-90307: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: fix heap information leak on a truncated SRPCREDREQ srprecvdone passes wc-bytelen to srpprocessrsp. It passes nothing to srpprocesscredreq and srpprocessaerreq, which read fixed-size fields from the receive buffer witho...

CVE-2026-90309: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: Hold CQ references when processing EQ events EQ handlers look up CQs from dev-cqxa and invoke CQ completion or error callbacks outside the xarray lock. erdmadestroycq can erase the CQ from the xarray and free its queu...

PT-2026-94822

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA/erdma component. The CEQ interrupt handler schedules eqc-tasklet, which executes the erdma ceq completion handler function to read the...

PT-2026-94905

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA mlx5 component where the devx free subscription function can remain queued after the last DevX event file drops its module reference or an auxiliary driver...

CVE-2026-90219: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Free debugfs on registration failure c4iwalloc creates the per-device debugfs tree dev-debugfsroot via setupdebugfs, but it is removed only in c4iwremove, not in c4iwdealloc. When RDMA device registration fails, the...

PT-2026-94803

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the RDMA bnxt re component, the bnxt re mmap function rejects VM WRITE flags for DBR PAGE and TOGGLE PAGE memory mappings. However, a read-only mapping may still retain the VM MAYWRIT...

PT-2026-94816

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA core component. When accessing a Completion Queue CQ via the netlink path, the synchronization relies on rdma restrack get. Because rdma restrac...

PT-2026-94817

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA core component. When accessing a counter through the netlink path, the synchronization relies on rdma restrack get. Because rdma restrack del is...

PT-2026-94819

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA core component. When accessing a Completion Queue CQ via the netlink path, the synchronization relies on rdma restrack get. Because rdma restrac...

PT-2026-94820

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA core component. When querying a Queue Pair QP via the netlink flow, the synchronization relies on rdma restrack get. However, during the QP...

PT-2026-94821

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the RDMA mana ib component. The function mana table store ud qp publishes a Queue Pair QP at its send-queue id before inserting the receive-queue id,...

PT-2026-94831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/nldev component where the nested attribute RDMA NLDEV ATTR STAT HWCOUNTERS is not properly validated. The top-level policy only validates the container and...

PT-2026-94835

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the RDMA/hfi1 component, the function set txreq header ahg fails to check the return value of sdma txinit ahg. When sdma txinit ahg fails, it returns before initializing tx-txreq, but...

PT-2026-94898

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA hfi1 driver where the hfi1 init dd function allocates shared AIP/VNIC RX support. If the hfi1 init or hfi1 register ib device functions subsequently fail, the...

PT-2026-94949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bng re component where the wait for resp function ignores the expiry of wait event timeout. If a response slot remains in use after the timeout and a polled...

PT-2026-94950

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/irdma component where userspace could deregister Memory Regions MRs that back Queue Pair QP, Completion Queue CQ, and Send Request Queue SRQ rings. This is...

PT-2026-94764

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack out-of-bounds read exists in the RDMA/mlx5 cc params debugfs. The get param function reads a congestion parameter as a u32 but formats it using a signed %d into an 11-byte stack...

PT-2026-94765

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/cxgb4 component where the write tpt entry function fails to properly manage the preallocated skb socket buffer during fatal error states or allocation failure...