PT-2026-72813

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like num sge or...

CVE-2026-74395: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference MLX5IBMETHODDEVXSUBSCRIBEEVENT links eventsub into sublist before initializing the fields used by the shared error path. If eventfdctxfdget then fails, the unwind path...

CVE-2026-74378: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in getsrqwqe getsrqwqe reads wqe-dma.numsge from the shared receive queue buffer, which is mapped into userspace. It validates numsge against maxsge, but then re-reads the same field to calculat...

CVE-2026-72499: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-72498: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid displaying the kernel pointer While dumping the info on MR using the rdma tool, we dump the mrhwq which is a kernel pointer. There is no need to expose this value for end user. So avoid it...

CVE-2026-74377: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

CVE-2026-74296: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware...

PT-2026-72656

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re id before removal registration rpcrdma create id registers ep-re rn with the rpcrdma ib client before returning the new rdma cm id to rpcrdma ep create. However rpcrdma ep create currently stores that...

CVE-2026-74346: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix OOB read during CQ MR registration Sashiko pointed out an unrelated bug during a previous patch: https://sashiko.dev//patchset/20260512183852.614045-1-jmoroni%40google.com This change fixes the bug by eliminating...

CVE-2026-74394: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: fix integer overflow in immediate data length check immbuf-len is a user-controlled uint32t received from the network. Adding it to immdataoffset without overflow checking allows a malicious initiator to send...

PT-2026-72735

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR aging push to queue error flow Aging pools with pinned handles requires moving handles from the active queue to a non-empty inactive queue that might fail on new page allocation, we are currently not handling...

PT-2026-72683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where applications can request multiple Work Completion WC pages for the same ucontext, although only one WC page per ucontext is supported...

PT-2026-72733

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/mlx5 component where the set rq size function computes the Receive Queue RQ Work Queue Element WQE size using a bitwise shift operation based on the...

PT-2026-72195

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: free mlx5 st idx data on final dealloc Workloads that repeatedly allocate and release mkeys carrying TPH steering-tag hints e.g. churning RDMA MRs leak one struct mlx5 st idx data per cycle; kmemleak flags it as...

PT-2026-72689

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/bnxt re component where the dpi variable is only initialized during the BNXT RE ALLOC WC PAGE process but is subsequently copied across all cases, leading to...

PT-2026-72825

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix log flood after cmd mbox failure hns roce cmd mbox is the command interface between driver and hardware. When hardware is abnormal, the unlimited error printings after hns roce cmd mbox failure will cause log flood...

PT-2026-72657

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the xprtrdma component where the rpcrdma cm event handler function incorrectly handles the RDMA CM EVENT ADDR CHANGE event. When this event occurs before RDMA CM EVENT...

PT-2026-72770

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/nldev component where locking is insufficient when accessing mr-pd. Due to rereg mr, the Protection Domain PD is variable, causing race conditions during...

CVE-2026-72500: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...

PT-2026-72781

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the RDMA/siw component regarding endpoint and socket association handling. Disassociating a socket from an endpoint using the siw socket disassoc function may release...