CVE-2026-97477 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
When __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path jumps to err_mode which frees the counter without decrementing port_counter->num_counters. The only place that decrements is rdma_counter_free(), which is unreachable since the counter was never successfully bound.
This leak accumulates across repeated failures, permanently preventing the port from switching to AUTO mode (-EBUSY in __counter_set_mode()) and blocking the MANUAL→NONE auto-revert in rdma_counter_free(). When the mode was NONE before the call, the MANUAL mode set by __counter_set_mode() also leaks since the revert logic is never reached.
Add an err_bind label between the num_counters increment and the existing err_mode label. It decrements num_counters and mirrors the MANUAL→NONE revert from rdma_counter_free(), ensuring the port state is fully restored on bind failure.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in the Linux kernel's RDMA counter subsystem represents a resource management flaw within the alloc_and_bind function, specifically concerning the handling of reference counts during queue pair binding operations. This issue stems from an incomplete error handling path when the __rdma_counter_bind_qp routine fails to successfully bind a Queue Pair to a specified counter object. In this scenario, the kernel increments the port's num_counters field to reflect the allocation but subsequently jumps to an err_mode label upon failure. The logic at err_mode proceeds to free the allocated counter structure without decrementing the corresponding num_counters value in the parent port structure. This creates a discrepancy where the system believes more counters are actively bound than actually exist, leading to a persistent state inconsistency that affects subsequent RDMA operations on the affected hardware port.
The operational impact of this reference count leak is significant and can lead to denial-of-service conditions for RDMA functionality on the specific network interface card involved. As repeated bind attempts fail due to transient errors or resource constraints, the num_counters value accumulates erroneously high values. This inflated counter prevents the port from transitioning into AUTO mode because __counter_set_mode() returns an -EBUSY error when it detects that counters are still in use. Furthermore, the mechanism designed to automatically revert a manually set counter configuration back to NONE upon cleanup is rendered ineffective. Since the bind operation never completes successfully, the rdma_counter_free function, which contains the logic for this automatic revert, is bypassed entirely during the error path execution. Consequently, if the port was previously in MANUAL mode, that state also leaks and persists indefinitely until a system reboot or manual intervention resets the driver state.
From a classification perspective, this vulnerability aligns with CWE-401, which describes a missing release of memory after successful allocation, although it specifically manifests as a reference count leak rather than raw memory leakage. It can be mapped to ATT&CK technique T1529, System Shutdown or Reboot, in the context that an attacker inducing repeated bind failures could effectively disable RDMA capabilities on a host by exhausting its counter resources, thereby forcing reliance on less efficient software-based networking paths or requiring administrative restarts to restore functionality. The flaw highlights critical gaps in defensive coding practices where error paths must mirror all state modifications made during the successful execution path to ensure atomicity and consistency of system states.
The resolution involves restructuring the error handling logic within alloc_and_bind by introducing a dedicated err_bind label positioned between the incrementation of num_counters and the existing err_mode label. This new error branch ensures that when __rdma_counter_bind_qp fails, the kernel correctly decrements the port's num_counters field to maintain accurate resource tracking. Additionally, it implements the same MANUAL-to-NONE revert logic found in rdma_counter_free, ensuring that any mode changes initiated during the bind attempt are rolled back properly. This fix restores the integrity of the RDMA counter subsystem by guaranteeing that partial failures do not leave the hardware port in a locked or inconsistent state, thereby preserving system stability and preventing resource exhaustion attacks targeting this specific kernel component.