Vulnerability-Lookup

CVE-2026-100075 (GCVE-0-2026-100075)

Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 14:41

Title

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/af00051dbc9f467d4…
https://git.kernel.org/stable/c/717ab4d0614e9446b…
https://git.kernel.org/stable/c/f1f2252da52cdda91…
https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa…
https://git.kernel.org/stable/c/be1478849e1abb1e1…
https://git.kernel.org/stable/c/af073bd245180393b…
https://git.kernel.org/stable/c/bd02d644bd19a2795…
https://git.kernel.org/stable/c/b38f98e176050850f…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af00051dbc9f467d4840ec709680660a3f8990fa (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < 717ab4d0614e9446bf8e2de6229464499e4008d6 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f1f2252da52cdda912da9993f39f58783b01b38f (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < be1478849e1abb1e12dc12e14cdbf800cc6fa99a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af073bd245180393bcb15d33d3990a6bdc32593a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < bd02d644bd19a2795c018635d273d91e45d2bb95 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < b38f98e176050850f41bb6415f3a71400056623e (git)	guessed
Linux	Linux	Affected: 4.7 Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb-\u003edesc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator\u0027s SRP_CMD IU. The path is srpt_recv_done-\u003esrpt_handle_new_iu-\u003esrpt_handle_cmd-\u003esrpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db-\u003elen=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i\u003e=1 every time, leaving n_rw_ctx\u003e=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target\u0027s administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host\u0027s kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd\u0027s release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree\u0027d rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx-\u003esg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:03.253Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
        },
        {
          "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
        },
        {
          "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
        },
        {
          "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
        }
      ],
      "title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-100075",
    "datePublished": "2026-09-25T13:06:47.399Z",
    "dateReserved": "2026-09-25T10:25:14.456Z",
    "dateUpdated": "2026-09-25T14:41:03.253Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/ulp/srpt/ib_srpt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
                    "status": "affected",
                    "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
                    "status": "affected",
                    "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
                    "status": "affected",
                    "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
                    "status": "affected",
                    "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
                    "status": "affected",
                    "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
                    "status": "affected",
                    "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
                    "status": "affected",
                    "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
                    "status": "affected",
                    "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/infiniband/ulp/srpt/ib_srpt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.110",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
          }
        ],
        "id": "CVE-2026-100075",
        "lastModified": "2026-09-25T15:17:52.117",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T14:17:14.163",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}

FKIE_CVE-2026-100075

Vulnerability from fkie_nvd - Published: 2026-09-25 14:17 - Updated: 2026-09-25 15:17

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
    }
  ],
  "id": "CVE-2026-100075",
  "lastModified": "2026-09-25T15:17:52.117",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-25T14:17:14.163",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-6WCW-WCGC-6J9R

Vulnerability from github – Published: 2026-09-25 15:31 – Updated: 2026-09-25 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits.

Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-100075"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T14:17:14Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error.",
  "id": "GHSA-6wcw-wcgc-6j9r",
  "modified": "2026-09-25T15:31:48Z",
  "published": "2026-09-25T15:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100075"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-100075 (GCVE-0-2026-100075)

FKIE_CVE-2026-100075

GHSA-6WCW-WCGC-6J9R

Tags

Sightings

Nomenclature

Related by attack behaviour