PT-2026-72656

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re id before removal registration rpcrdma create id registers ep-re rn with the rpcrdma ib client before returning the new rdma cm id to rpcrdma ep create. However rpcrdma ep create currently stores that...

PT-2026-72687

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA bnxt re driver where a CQ toggle page is freed before the firmware teardown completes. This can lead to a situation where an NQ interrupt arriving during the...

PT-2026-72813

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num sge or...

PT-2026-72732

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/mlx5 component where the software-provided UAR User Access Region index was being released instead of the index provided by the hardware. The fix ensures that...

PT-2026-72688

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA bnxt re component where the SRQ toggle page is freed before the firmware teardown completes. This can lead to a situation where an NQ interrupt arriving durin...

PT-2026-72655

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where the rpcrdma xprt connect function ignores the return value of frwr wp create. The frwr wp create function is responsible for creating a singleto...

CVE-2026-72491: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/9p: fix race condition on rdma-state in transrdma.c The rdma-state field is modified without holding reqlock in both recvdone and p9cmeventhandler, while rdmarequest accesses the same field under the reqlock spinlock. This...

PT-2026-72682

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The RDMA/irdma driver contains an issue where a waitqueue and an explicit request done flag were used without proper memory barriers. Memory barriers are synchronization primitives that...

PT-2026-72814

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get srq wqe get srq wqe reads wqe-dma.num sge from the shared receive queue buffer, which is mapped into userspace. It validates num sge against max sge, but then re-reads the same field to...

CVE-2026-74346: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...

CVE-2026-74395: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

CVE-2026-74378: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validates numsge against maxsge, but then re-reads the same field to calculat...

CVE-2026-74377: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

CVE-2026-72498: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

CVE-2026-74296: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

CVE-2026-72499: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-74345: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix endpoint/socket association handling Disassociating a socket from an endpoint via siwsocketdisassoc may release the last reference on that endpoint and free it. Therefore, don't clear the endpoints socket pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-72494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barrie...

Linux Distros Unpatched Vulnerability : CVE-2026-74389

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/hns: Fix log flood after cmdmbox failure hnsrocecmdmbox is the command interface between driver and hardware. When hardware is abnormal, the unlimited erro...

Linux Distros Unpatched Vulnerability : CVE-2026-72495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/bnxtre: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per uconte...