CVE-2026-98352
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDR_RESOLVED handler via ib_cq_pool_get(), before the peer is connected. create_cm() can return -ERESTARTSYS from wait_event_interruptible_timeout() without destroying the CM ID. The init_conns() and stop-and-destroy paths then call destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards rdma_destroy_id(). CMA serializes the handler against rdma_destroy_id() with handler_mutex, but that does not order the GET against destroy_con_cq_qp(). If ADDR_RESOLVED has already passed the DESTROYING check, it can take con_mutex, GET credits, and then lose the con to kfree. Device unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup(). Set a per-connection flag under con_mutex before CQ/QP teardown so a racing ADDR_RESOLVED cannot borrow credits after teardown has begun.
How to fix
- Linux Linuxa82cca40139d9fcae8208901856bd5bb4051f097, 74c4ed55e61f1b65ddbebc5b635d136461a1c3da, 6f8020fe7465f49e234a576c04e415e9d08c7878, 31024e158b45358370a0a14ed96589e6aa62d6cb, 8f253d5893f991742464b9e7203c43fc08d0aa11, bf88ac4867050112a6c819c8d1a7209bf48ef427, 2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 3b89e92c2a95a39c38a3808f4528e502a39bd94d ≤ v < a82cca40139d9fcae8208901856bd5bb4051f097, 3b89e92c2a95a39c38a3808f4528e502a39bd94d ≤ v < 74c4ed55e61f1b65ddbebc5b635d136461a1c3da, 3b89e92c2a95a39c38a3808f4528e502a39bd94d ≤ v < 6f8020fe7465f49e234a576c04e415e9d08c7878, 3b89e92c2a95a39c38a3808f4528e502a39bd94d ≤ v < 31024e158b45358370a0a14ed96589e6aa62d6cb, 3b89e92c2a95a39c38a3808f4528e502a39bd94d ≤ v < 8f253d5893f991742464b9e7203c43fc08d0aa11, 3b89e92c2a95a39c38a3808f4528e502a39bd94d ≤ v < bf88ac4867050112a6c819c8d1a7209bf48ef427, 3b89e92c2a95a39c38a3808f4528e502a39bd94d ≤ v < 2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda, 5.13 | a82cca40139d9fcae8208901856bd5bb4051f097, 74c4ed55e61f1b65ddbebc5b635d136461a1c3da, 6f8020fe7465f49e234a576c04e415e9d08c7878, 31024e158b45358370a0a14ed96589e6aa62d6cb, 8f253d5893f991742464b9e7203c43fc08d0aa11, bf88ac4867050112a6c819c8d1a7209bf48ef427, 2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.