CVE-2026-93104 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rvt: Return NULL after port allocation failure
rvt_alloc_device() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free.
Return NULL immediately after deallocation so callers can propagate the allocation failure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's RDMA over Converged Ethernet (RoCE) implementation contains a critical memory management flaw within the rvt_alloc_device function, which is responsible for initializing InfiniBand devices. This vulnerability stems from an improper error handling sequence during device initialization. Specifically, when the system fails to allocate memory for the port array associated with the new IB device, the code correctly proceeds to deallocate or free any previously allocated resources related to that device structure. However, instead of returning a null pointer to signal this failure to the calling functions, the function erroneously returns the pointer to the now-freed memory block. This creates a classic use-after-free scenario where subsequent execution paths assume the returned pointer is valid and attempt to dereference it.
From a technical perspective, this flaw represents a severe violation of safe memory management practices in kernel space. When a caller receives a non-null value from rvt_alloc_device, it interprets this as successful device allocation and proceeds with operations that involve accessing members or functions within the IB device structure. Since the underlying memory has already been released back to the system allocator, these dereferences access invalid memory addresses. This can lead to kernel panics, data corruption, or unpredictable behavior depending on what other allocations have occupied that freed memory region at the time of access. The issue is particularly dangerous because it bypasses standard error propagation mechanisms, allowing corrupted state to persist deeper into the driver stack.
The operational impact of this vulnerability includes potential denial-of-service conditions through kernel crashes, which would disrupt RDMA services and potentially affect system stability if the affected device is critical for network operations or high-performance computing tasks. In more severe scenarios involving crafted inputs that trigger specific timing windows in memory allocation, an attacker with local access might exploit the use-after-free condition to achieve arbitrary code execution by controlling the contents of the freed memory before it is reused. This aligns with CWE-416, which describes Use After Free vulnerabilities where a pointer references deallocated memory leading to undefined behavior and potential security breaches.
To mitigate this risk, immediate patching of the Linux kernel is required to ensure that rvt_alloc_device returns NULL upon allocation failure rather than returning the freed pointer. This allows callers to properly detect the error condition and handle it gracefully without attempting to use invalid pointers. System administrators should apply vendor-provided updates or backported patches for affected distributions as soon as they become available. Additionally, developers integrating RDMA drivers into custom kernel builds must verify that their initialization routines correctly check return values from device allocation functions against NULL before proceeding with any further operations involving the device structure.
This vulnerability also relates to ATT&CK technique T1059, Command and Scripting Interpreter, as exploitation could potentially lead to remote code execution capabilities if combined with other vulnerabilities in a chain attack scenario. Furthermore, it touches upon CWE-252, Checkpoint Failure, where the system fails to properly validate or handle error states during critical resource allocation processes. Ensuring robust error handling paths that explicitly return failure indicators is essential for maintaining kernel integrity and preventing exploitation of such memory safety issues in production environments.