CVE-2026-90415 - Vulnerability Details

- RDMA/cxgb4: free STAG index when TPT entry write fails

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cxgb4: free STAG index when TPT entry write fails

write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and
bumps stats.stag.cur before programming the entry. When
write_adapter_mem() fails, it returns the error without releasing the index
or reversing the statistic. No MR is inserted into rhp->mrs, so
deregistration never reclaims it, leaking the index until device teardown.

Record whether this call allocated the index and, on a failed write, return
it to tpt_table and decrement stats.stag.cur. Key the rollback on both the
write error and that flag, not the error alone: a non-reset update carries
a caller-owned STAG that this call did not allocate and must not free.

Published: 2026-09-17

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the RDMA/cxgb4 driver of the Linux kernel. When the write_tpt_entry function attempts to program a TPT entry and write_adapter_mem fails, the driver mistakenly fails to release the STAG index it previously allocated. The corresponding counter in stats.stag.cur is also left unchanged. Over time, this results in an unchecked growth of allocated indices, eventually exhausting kernel resources and degrading RDMA functionality.

Affected Systems

This issue affects all Linux kernel builds that include the cxgb4 RDMA driver. The specific affected kernel versions are not listed, so any deployment using the default Linux kernel with the cxgb4 driver should be considered potentially vulnerable until an updated kernel is available.

Risk and Exploitability

The EPSS score indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because it is a kernel bug, it requires privileged execution to exploit, though it could be triggered by normal kernel operation if the RDMA device experiences write failures. The potential impact is resource exhaustion that could lead to a denial of RDMA services or general kernel instability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ec3eead217181d7360a11317a888ceb30807867c`	affected	< 5fe4731bfbd8d83c4a14b4af3a27329969ce8a99
`ec3eead217181d7360a11317a888ceb30807867c`	affected	< 8f6976d635d190e3d7af7103daaa581cf1ccc12e
`ec3eead217181d7360a11317a888ceb30807867c`	affected	< 9eeafcda1d6c11f0eec532243c4e96ec8c632bd7
`ec3eead217181d7360a11317a888ceb30807867c`	affected	< 5a21e5114cec4cd3f8a2843d4c46bc49634d6e96
`ec3eead217181d7360a11317a888ceb30807867c`	affected	< 2f17ca7ab5269ac2504e1039c3921373dccd7712
`ec3eead217181d7360a11317a888ceb30807867c`	affected	< a2e37d1ab773be3cd26b1c19593ca2dbcece9c57
`ec3eead217181d7360a11317a888ceb30807867c`	affected	< a64e2beb450179a5d43034af8d5476a11eac1486
`ec3eead217181d7360a11317a888ceb30807867c`	affected	< fdfb5cea4bf070cdb31d997efd87bb684df041fd

Linux

affected

Version	Status	Constraints
`3.5`	affected	—
`0`	unaffected	< 3.5
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ec3eead217181d7360a11317a888ceb30807867c,5fe4731bfbd8d83c4a14b4af3a27329969ce8a99)`	affected	code_commit	—
`[ec3eead217181d7360a11317a888ceb30807867c,8f6976d635d190e3d7af7103daaa581cf1ccc12e)`	affected	code_commit	—
`[ec3eead217181d7360a11317a888ceb30807867c,9eeafcda1d6c11f0eec532243c4e96ec8c632bd7)`	affected	code_commit	—
`[ec3eead217181d7360a11317a888ceb30807867c,5a21e5114cec4cd3f8a2843d4c46bc49634d6e96)`	affected	code_commit	—
`[ec3eead217181d7360a11317a888ceb30807867c,2f17ca7ab5269ac2504e1039c3921373dccd7712)`	affected	code_commit	—
`[ec3eead217181d7360a11317a888ceb30807867c,a2e37d1ab773be3cd26b1c19593ca2dbcece9c57)`	affected	code_commit	—
`[ec3eead217181d7360a11317a888ceb30807867c,a64e2beb450179a5d43034af8d5476a11eac1486)`	affected	code_commit	—
`[ec3eead217181d7360a11317a888ceb30807867c,fdfb5cea4bf070cdb31d997efd87bb684df041fd)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.5`	affected	generic	—
`[0,3.5)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel release that incorporates the fix for the cxgb4 driver
If an immediate kernel upgrade is not feasible, unload or disable the cxgb4 module to prevent RDMA traffic from using the vulnerable driver
Monitor kernel logs for frequent write_adapter_mem failures and review STAG allocation statistics to detect early signs of leakage

Generated by OpenCVE AI on September 19, 2026 at 06:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712
https://git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96
https://git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99
https://git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e
https://git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7
https://git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57
https://git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486
https://git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd

History

Sat, 19 Sep 2026 06:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.
Title		RDMA/cxgb4: free STAG index when TPT entry write fails
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712 https://git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96 https://git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99 https://git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e https://git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7 https://git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57 https://git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486 https://git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:09:40.714Z

Updated: 2026-09-17T16:09:40.714Z

Reserved: 2026-09-11T19:38:34.813Z

Link: CVE-2026-90415

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:17:45.647

Modified: 2026-09-17T17:17:45.647

Link: CVE-2026-90415

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-19T11:30:06Z

Weaknesses

CWE-401
Missing Release of Memory after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object