CVE-2026-98152

The vulnerability arises when NVMe over RDMA connect requests exceed the backlog limit, causing the kernel to drop a device reference but not release the newly allocated queue and its InfiniBand resources. This leads to a memory and resource leak classified as CWE‑401 and CWE‑772. Over time, repeated exploitation can exhaust kernel memory or IB resources, potentially destabilizing the system or creating a denial‑of‑service condition.

The flaw is present in the Linux kernel’s NVMe RDMA implementation (nvmet‑rdma). Any distribution containing the default nvmet‑rdma driver is susceptible until the patch is applied. No specific kernel versions are singled out, so the impact applies broadly to all affected kernels containing nvmet‑rdma support.

The EPSS score is below 1%, indicating a very low exploitation probability. The CVSS score of 5.5 reflects a medium severity. The vulnerability is not listed in the CISA KEV catalog. The expected attack vector would require an adversary to repeatedly initiate RDMA connect requests that overwhelm the backlog, triggering the leaking condition. Successful exploitation would lead to resource exhaustion, potentially causing a denial of service. Because repeated triggering is necessary and the exploit depends on RDMA access, the real‑world risk is considered moderate to low at present.