CVE-2026-100075 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits.
Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel vulnerability identified within the RDMA/srpt subsystem involves a critical resource management flaw in the srpt_alloc_rw_ctxs function, specifically concerning the handling of multi-buffer indirect descriptors during memory context allocation failures. This issue manifests when the allocation process encounters an error partway through processing multiple buffers, triggering an unwind path intended to clean up previously allocated resources. While this cleanup routine correctly attempts to destroy RDMA contexts, it fails to properly reset or clear critical accounting variables such as n_rw_ctx and n_rdma, nor does it nullify the dangling rw_ctxs pointer that references freed heap memory. This incomplete state restoration leaves the kernel in an inconsistent condition where internal counters no longer accurately reflect the actual number of allocated resources, creating a discrepancy between tracked allocations and reality.
The operational impact of this inconsistency is severe because subsequent operations relying on send queue availability accounting are directly affected. Functions such as srpt_queue_response and srpt_write_pending depend on accurate values for n_rw_ctx to determine how many work requests can be safely queued without exhausting available credits in the send queue. When these functions execute after a failed allocation, they utilize the stale counter values rather than corrected ones, leading to incorrect calculations of sq_wr_avail. This miscalculation results in the system subtracting an erroneous number of send queue credits, which can cause significant desynchronization between the driver's internal state and the actual hardware or firmware expectations regarding resource availability.
From a security perspective, this vulnerability aligns with CWE-401, Missing Release of Memory after Effective Lifetime, as well as CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, due to the race-like nature of inconsistent state updates in a concurrent environment. The stale pointers and incorrect counters can potentially lead to use-after-free scenarios if the dangling rw_ctxs pointer is accessed later, or result in denial-of-service conditions through resource exhaustion caused by corrupted accounting data. In terms of MITRE ATT&CK frameworks, this flaw relates to techniques involving improper cleanup that may facilitate further exploitation, such as privilege escalation via memory corruption or service disruption through queue saturation attacks where an attacker could potentially manipulate the send queue limits to cause system instability or crashes.
To mitigate this vulnerability, it is essential to ensure that all resource accounting variables are reset and pointer references are cleared immediately after freeing heap allocations during error paths. The fix involves modifying srpt_alloc_rw_ctxs to explicitly zero out n_rw_ctx and n_rdma values and set rw_ctxs to NULL before returning an error code. This ensures that the kernel state remains consistent even when allocation fails midway through a complex multi-buffer operation. System administrators should apply the latest kernel patches addressing this specific commit in the RDMA/srpt subsystem, as unpatched systems remain susceptible to potential denial-of-service attacks and memory safety violations stemming from these accounting discrepancies. Regular auditing of driver error handling paths for similar incomplete cleanup routines is also recommended to prevent analogous issues across other components of the Linux kernel networking stack.