CVE-2026-74299 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Fix FRMR aging push to queue error flow
Aging pools with pinned handles requires moving handles from the active queue to a non-empty inactive queue that might fail on new page allocation, we are currently not handling the fault and leaking any mkey that fails the push.
Fix by Introducing push_queue_to_queue_locked() that fills the destination's partial tail page from the source and then splices the remaining source pages onto the destination, performing no allocation.
Replace the per-handle move loop in age_pinned_pool() and the open-coded splice in pool_aging_work() with calls to the helper. As the helper cannot fail under memory pressure, removing a class of GFP_ATOMIC allocations under the pool lock and simplifying the error flow.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's RDMA/core subsystem where a critical flaw occurs during FRMR (Fast Registration Memory Region) aging operations. The issue manifests when attempting to move pinned handles from an active queue to an inactive queue within aging pools, which requires memory allocation for new page structures. When this allocation fails under memory pressure conditions, the system does not properly handle the error state, resulting in memory leaks of mkeys that fail during the push operation. This represents a classic resource management failure where the kernel fails to clean up allocated resources upon operation failure.
The technical flaw stems from inadequate error handling in the memory management flow during queue operations within RDMA core components. Specifically, the aging pool mechanism attempts to move handles between queues without proper allocation failure handling, leading to mkey leaks when page allocation for new queue structures fails. This vulnerability directly relates to CWE-401 Memory Leak and CWE-754 Improper Check for Unusual Exceptional Conditions, as it fails to properly validate memory allocation outcomes during queue operations.
The operational impact of this vulnerability extends beyond simple resource leakage, potentially leading to system instability and performance degradation under memory-constrained conditions. When the RDMA subsystem experiences high memory pressure during aging operations, the failure to handle allocation errors properly causes mkey resources to remain allocated indefinitely, eventually exhausting available memory resources. This can particularly affect high-performance computing environments where RDMA is heavily utilized for low-latency network communications, potentially causing system crashes or severe performance degradation in applications relying on RDMA functionality.
The fix implements a new helper function called push_queue_to_queue_locked() that addresses the core problem by eliminating the problematic allocation pattern entirely. This solution works by filling the destination's partial tail page from the source content and then splicing any remaining source pages onto the destination queue, all without performing additional memory allocations during the operation. The implementation replaces the previous per-handle move loop in age_pinned_pool() and the open-coded splice in pool_aging_work() with calls to this new helper function. This approach aligns with ATT&CK technique T1484.001 for Privilege Escalation through Resource Exhaustion, as it prevents the accumulation of leaked resources that could otherwise be exploited to exhaust system resources.
By removing the class of GFP_ATOMIC allocations under the pool lock, the fix significantly simplifies the error handling flow and eliminates a major source of potential deadlocks or race conditions. The new helper function cannot fail under memory pressure because it avoids allocation entirely, ensuring that queue operations complete successfully regardless of memory availability. This change reduces complexity in the codebase while improving system reliability, as demonstrated by the reduction in error paths and elimination of potential allocation-related failures during critical RDMA operations.
The solution represents a robust approach to memory management within kernel subsystems, following best practices for resource handling under stress conditions. The implementation ensures that even when system memory is constrained, queue operations will complete successfully without leaking resources or requiring complex error recovery mechanisms. This addresses both immediate security concerns related to resource exhaustion and long-term system stability issues that could arise from the accumulation of leaked mkeys during RDMA operations.