CVE-2026-90417 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
When the device is in the fatal error state, write_tpt_entry() returns -EIO before handing the caller's preallocated skb to the transmit path; its allocation-failure returns do the same. c4iw_dereg_mr() ignores the error and frees mhp, leaking mhp->dereg_skb. c4iw_get_dma_mr() instead frees the skb a second time after dereg_mem() already consumed it, a double free.
Make write_tpt_entry() the sole owner of a non-NULL skb, freeing it on every return preceding handoff to c4iw_ofld_send(): fatal error, tpt and stag allocation failure. c4iw_ofld_send() consumes the skb on success and error alike, so drop the redundant kfree_skb() in c4iw_get_dma_mr() after dereg_mem().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel vulnerability identified within the RDMA/cxgb4 driver involves critical memory management errors during the handling of Transport Protection Table entries. The core issue resides in the write_tpt_entry function, which is responsible for managing socket buffer allocations and their subsequent transmission to hardware. Under specific failure conditions, such as when the device enters a fatal error state or encounters allocation failures for TPT and STAG resources, the function returns an -EIO error code without properly transferring ownership of the preallocated skb to the transmit path. This deviation from expected resource lifecycle management creates a scenario where memory is either leaked or freed multiple times, depending on the calling context and subsequent error handling logic in higher-level functions like c4iw_dereg_mr and c4iw_get_dma_mr.
In the case of memory region deregistration via c4iw_dereg_mr, the function ignores the -EIO return value from write_tpt_entry and proceeds to free the main hardware page structure mhp. However, because write_tpt_entry did not hand off or free the associated dereg_skb due to its early error exit, this buffer remains allocated in memory but orphaned from any active reference count management. This results in a persistent memory leak that accumulates over time as operations fail repeatedly under degraded device conditions. Such leaks can eventually lead to resource exhaustion on systems with high rates of RDMA connection teardowns or hardware errors, potentially impacting system stability and performance by consuming kernel memory without releasing it back to the pool for reuse.
Conversely, in scenarios involving c4iw_get_dma_mr, a different but equally severe flaw manifests as a double free vulnerability. Here, write_tpt_entry fails and returns an error, yet the calling function c4iw_get_dma_mr proceeds to call dereg_mem which consumes or frees the skb internally. Subsequently, c4iw_get_dma_mr attempts to free the same skb again using kfree_skb after detecting the failure from dereg_mem. This double freeing of kernel memory corrupts internal slab allocator data structures and can lead to arbitrary code execution if an attacker can influence the allocation patterns that follow the corrupted metadata. Double frees are particularly dangerous as they allow for heap corruption, which is a common precursor to privilege escalation exploits in modern operating systems where kernel space access provides significant control over system operations.
The resolution of this vulnerability requires enforcing strict ownership semantics for socket buffers within the cxgb4 driver logic. The fix establishes write_tpt_entry as the sole owner of any non-NULL skb passed into it, mandating that the function must free the buffer on every return path preceding a handoff to c4iw_ofld_send. This includes cases involving fatal device errors and allocation failures for TPT or STAG resources. By ensuring that write_tpt_entry always cleans up its allocated resources before returning an error code, the possibility of orphaned buffers is eliminated. Additionally, redundant kfree_skb calls in c4iw_get_dma_mr are removed because c4iw_ofld_send now handles consumption and cleanup on both success and error paths, thereby preventing the double free condition entirely.
From a classification perspective, this vulnerability aligns with CWE-401 Missing Release of Memory after Effective Lifetime which describes the leak scenario where resources are not freed upon failure exits. The double free aspect maps directly to CWE-415 Double Free which is critical for heap corruption attacks. In terms of attack vectors and techniques, these flaws relate to ATT&CK technique T1203 Exploitation for Defense Evasion or potentially T1059 Command and Scripting Interpreter if the resulting instability leads to system crashes that disrupt security monitoring services. More specifically, memory corruption issues like double frees are often leveraged in post-exploitation phases to gain kernel-level privileges, making this a high-severity issue from a defensive standpoint despite being triggered by hardware error states rather than direct user input.
Mitigation strategies for organizations running affected Linux kernels involve applying the upstream patch that corrects these memory management paths immediately upon availability. For environments where immediate patching is not feasible due to stability concerns or release cycles, monitoring kernel logs for repeated -EIO errors from cxgb4 devices can serve as an indicator of potential exploitation attempts targeting this flaw. Administrators should also consider implementing strict resource limits and monitoring tools that track memory usage trends in real-time to detect anomalies indicative of the described leaks. Furthermore, enabling Kernel Self-Protection features such as SLAB hardening or KASAN (Kernel Address Sanitizer) during development and testing phases can help identify similar logic errors before they reach production environments, reducing the attack surface for future vulnerabilities of this nature.