CVE-2026-90218 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cma: Fix WARNING in res_to_rt

syzbot reported a WARN_ON(!res->dev) in res_to_rt() triggered via
addr_handler() during asynchronous address resolution:

"
WARNING: drivers/infiniband/core/restrack.c:138 at res_to_rt+0x1c4/0x230
CPU#1: kworker/u8:4/59
Modules linked in:
CPU: 1 UID: 0 PID: 59 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Compute Engine, BIOS Google 07/24/2026
Workqueue: ib_addr process_one_req
RIP: 0010:res_to_rt+0x1c4/0x230 drivers/infiniband/core/restrack.c:138
RSP: 0018:ffffc9000201f850 EFLAGS: 00010293
RAX: ffffffff88d00ce5 RBX: ffff88807f0fd4f8 RCX: ffff88801e6e0000
RDX: 0000000000000000 RSI: ffffffff8fd996f0 RDI: 0000000000000003
RBP: 0000000000000000 R08: ffff88801e6e0000 R09: 000000000000000a
R10: 0000000000000009 R11: 0000000000000000 R12: dffffc0000000000
R13: 1ffff1100fe1fa9f R14: 0000000000000000 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff888125012000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00001d559c3d2000 CR3: 0000000077c4c000 CR4: 00000000003526f0
Call Trace:
<TASK>
rdma_restrack_add+0x5a/0x8a0 drivers/infiniband/core/restrack.c:236
addr_handler+0x41a/0x5a0 drivers/infiniband/core/cma.c:3534
process_one_req+0x2eb/0x540 drivers/infiniband/core/addr.c:624
process_one_work kernel/workqueue.c:3375 [inline]
process_scheduled_works+0xc4e/0x1630 kernel/workqueue.c:3458
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3539
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
"

In addr_handler(), cma_acquire_dev_by_src_ip() is called to populate
id_priv->cma_dev and bind the associated ib_device to id_priv->id.device.
If cma_acquire_dev_by_src_ip() returns an error (non-zero status), the ID
remains unassociated with any RDMA device.

Previously, rdma_restrack_add(&id_priv->res) was invoked unconditionally
even when cma_acquire_dev_by_src_ip() failed, passing a resource with a
NULL dev pointer and triggering the WARN_ON assertion in res_to_rt().

Fix this by only adding the resource to restrack when acquiring the device
succeeds.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw occurs in the RDMA/cma part of the Linux kernel where a warning is triggered when a resource with a NULL device pointer is added to the restrack. The warning originates from a WARN_ON assertion in res_to_rt(), indicating a potential null‑pointer dereference that could lead to a kernel crash and service disruption. The bug is caused by unconditional resource addition even though device acquisition may have failed. Since the code path involves asynchronous RDMA address resolution, the warning would surface during RDMA traffic handling.

Affected Systems

Linux kernel builds that include the RDMA/cma subsystem prior to the fix. Any distribution or custom kernel that compiles the ib_device stack and does not contain the patch is affected. No specific version numbers are provided, but the issue applies to all kernels shipped without the documented change.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating a low probability of exploitation. The warning occurs during asynchronous RDMA address resolution, which typically requires RDMA traffic to be processed by the kernel; this is inferred to be a local or state‑dependent action but is not explicitly stated in the data. No known exploits or confirmed crash reports are cited. Consequently, the risk is low, with the principal concern being potential denial‑of‑service via kernel instability if the bug is triggered repeatedly.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c5ebaca402f5c5bd61ac8316feb2aa3a0be4d4a8`	affected	< 1d7e55ea64dd15769318ba2e0fe0956db82ba3c3
`cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa`	affected	< 39e83bb77fc92344cd62a373b311f096d812e548
`cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa`	affected	< 9c80273d663959504957606b9a24fe901ee2a4a1
`cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa`	affected	< 2a63cb9ea862ac7d947952b497eef6520853538c
`cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa`	affected	< f72957e0b31f2962f4c1089a9223f1206aa26983
`cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa`	affected	< 544e40805dbb6cfe64916bd4c8b238fec585ac2a
`cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa`	affected	< 64a2bd4cfc16c24f0a0e6321a2fd00ffde3e0a5b
`cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa`	affected	< c6d1ec4fbe56492bb88987d577f04a5fb6955f26
`073fdf539d4c022162db3d77a5afca1710f0de2d`	affected	—
`fa37a461bd6d9ee86e891ba3e4074a450e44c881`	affected	—
`5.10.37`	affected	< 5.10.270
`5.11.21`	affected	< 5.12
`5.12.4`	affected	< 5.13

Linux

affected

Version	Status	Constraints
`5.13`	affected	—
`0`	unaffected	< 5.13
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c5ebaca402f5c5bd61ac8316feb2aa3a0be4d4a8,1d7e55ea64dd15769318ba2e0fe0956db82ba3c3)`	affected	code_commit	—
`[cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa,39e83bb77fc92344cd62a373b311f096d812e548)`	affected	code_commit	—
`[cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa,9c80273d663959504957606b9a24fe901ee2a1)`	affected	code_commit	—
`[cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa,2a63cb9ea862ac7d947952b497eef6520853538c)`	affected	code_commit	—
`[cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa,f72957e0b31f2962f4c1089a9223f1206aa26983)`	affected	code_commit	—
`[cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa,544e40805dbb6cfe64916bd4c8b238fec585ac2a)`	affected	code_commit	—
`[cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa,64a2bd4cfc16c24f0a0e6321a2fd00ffde3e0a5b)`	affected	code_commit	—
`[cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa,c6d1ec4fbe56492bb88987d577f04a5fb6955f26)`	affected	code_commit	—
`[073fdf539d4c022162db3d77a5afca1710f0de2d,*]`	affected	code_commit	—
`[fa37a461bd6d9ee86e891ba3e4074a450e44c881,*]`	affected	code_commit	—
`[5.10.37,5.10.270)`	affected	semver	—
`[5.11.21,5.12)`	affected	semver	—
`[5.12.4,5.13)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.13,*]`	affected	generic	—
`[0,5.13]`	unaffected	generic	—
`[5.10.270,5.11.0]`	unaffected	semver	—
`[5.15.221,5.16.0]`	unaffected	semver	—
`[6.1.188,6.2.0]`	unaffected	semver	—
`[6.6.157,6.7.0]`	unaffected	semver	—
`[6.12.110,6.13.0]`	unaffected	semver	—
`[6.18.52,6.19.0]`	unaffected	semver	—
`[7.2.6,7.3.0]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the RDMA/cma patch fixing the NULL‑pointer error.
If no patch is available, disable the RDMA/cma functionality when it is not required by unloading the associated kernel modules.
Enable kernel logging or monitoring to detect the specific warning message from restrack.c, allowing early detection of accidental triggering.

Generated by OpenCVE AI on September 20, 2026 at 01:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0021.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1d7e55ea64dd15769318ba2e0fe0956db82ba3c3
https://git.kernel.org/stable/c/2a63cb9ea862ac7d947952b497eef6520853538c
https://git.kernel.org/stable/c/39e83bb77fc92344cd62a373b311f096d812e548
https://git.kernel.org/stable/c/544e40805dbb6cfe64916bd4c8b238fec585ac2a
https://git.kernel.org/stable/c/64a2bd4cfc16c24f0a0e6321a2fd00ffde3e0a5b
https://git.kernel.org/stable/c/9c80273d663959504957606b9a24fe901ee2a4a1
https://git.kernel.org/stable/c/c6d1ec4fbe56492bb88987d577f04a5fb6955f26
https://git.kernel.org/stable/c/f72957e0b31f2962f4c1089a9223f1206aa26983

History

Sun, 20 Sep 2026 01:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix WARNING in res_to_rt syzbot reported a WARN_ON(!res->dev) in res_to_rt() triggered via addr_handler() during asynchronous address resolution: " WARNING: drivers/infiniband/core/restrack.c:138 at res_to_rt+0x1c4/0x230 CPU#1: kworker/u8:4/59 Modules linked in: CPU: 1 UID: 0 PID: 59 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine, BIOS Google 07/24/2026 Workqueue: ib_addr process_one_req RIP: 0010:res_to_rt+0x1c4/0x230 drivers/infiniband/core/restrack.c:138 RSP: 0018:ffffc9000201f850 EFLAGS: 00010293 RAX: ffffffff88d00ce5 RBX: ffff88807f0fd4f8 RCX: ffff88801e6e0000 RDX: 0000000000000000 RSI: ffffffff8fd996f0 RDI: 0000000000000003 RBP: 0000000000000000 R08: ffff88801e6e0000 R09: 000000000000000a R10: 0000000000000009 R11: 0000000000000000 R12: dffffc0000000000 R13: 1ffff1100fe1fa9f R14: 0000000000000000 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff888125012000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00001d559c3d2000 CR3: 0000000077c4c000 CR4: 00000000003526f0 Call Trace: <TASK> rdma_restrack_add+0x5a/0x8a0 drivers/infiniband/core/restrack.c:236 addr_handler+0x41a/0x5a0 drivers/infiniband/core/cma.c:3534 process_one_req+0x2eb/0x540 drivers/infiniband/core/addr.c:624 process_one_work kernel/workqueue.c:3375 [inline] process_scheduled_works+0xc4e/0x1630 kernel/workqueue.c:3458 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3539 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> " In addr_handler(), cma_acquire_dev_by_src_ip() is called to populate id_priv->cma_dev and bind the associated ib_device to id_priv->id.device. If cma_acquire_dev_by_src_ip() returns an error (non-zero status), the ID remains unassociated with any RDMA device. Previously, rdma_restrack_add(&id_priv->res) was invoked unconditionally even when cma_acquire_dev_by_src_ip() failed, passing a resource with a NULL dev pointer and triggering the WARN_ON assertion in res_to_rt(). Fix this by only adding the resource to restrack when acquiring the device succeeds.
Title		RDMA/cma: Fix WARNING in res_to_rt
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1d7e55ea64dd15769318ba2e0fe0956db82ba3c3 https://git.kernel.org/stable/c/2a63cb9ea862ac7d947952b497eef6520853538c https://git.kernel.org/stable/c/39e83bb77fc92344cd62a373b311f096d812e548 https://git.kernel.org/stable/c/544e40805dbb6cfe64916bd4c8b238fec585ac2a https://git.kernel.org/stable/c/64a2bd4cfc16c24f0a0e6321a2fd00ffde3e0a5b https://git.kernel.org/stable/c/9c80273d663959504957606b9a24fe901ee2a4a1 https://git.kernel.org/stable/c/c6d1ec4fbe56492bb88987d577f04a5fb6955f26 https://git.kernel.org/stable/c/f72957e0b31f2962f4c1089a9223f1206aa26983

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:07:30.076Z

Updated: 2026-09-17T16:07:30.076Z

Reserved: 2026-09-11T19:38:34.793Z

Link: CVE-2026-90218

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:17.137

Modified: 2026-09-17T17:17:17.137

Link: CVE-2026-90218

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T01:30:16Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object