CVE-2026-98152 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
nvmet-rdma: fix queue leak when connect backlog is exceeded
When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The identified vulnerability resides within the Linux kernel's NVMe over RDMA (nvmet-rdma) subsystem, specifically affecting the connection management logic when handling incoming network requests. This component is responsible for establishing reliable data transfer channels between an NVMe target system and remote initiators using Remote Direct Memory Access technology. The core technical flaw occurs during the initialization phase of a new queue pair when the system's connect backlog limit has been reached. Under normal operational conditions, if the number of pending connections exceeds this predefined threshold, the kernel is designed to reject or drop excess requests to prevent resource exhaustion and maintain stability. However, in this specific scenario involving queues that are already in a disconnecting state, the error handling path fails to perform complete cleanup operations.
The technical deficiency lies in an incomplete reference counting mechanism within the connection teardown sequence. When pending disconnecting queues exceed the backlog limit, the code correctly drops the device reference count but neglects to release the memory allocated for the newly created queue structure and its associated InfiniBand resources. This omission results in a kernel memory leak where each such event consumes system RAM without releasing it back to the pool. Over time, particularly under high-load conditions or sustained connection churn, these leaked objects accumulate, leading to progressive degradation of system performance and potential eventual out-of-memory errors that could crash the host machine or disrupt storage services provided by the NVMe target.
From a security perspective, this vulnerability represents a classic resource exhaustion vector often categorized under CWE-401: Missing Release of Memory after Effective Lifetime. While it does not directly allow for arbitrary code execution or privilege escalation in its current form, it significantly impacts availability by depleting kernel memory resources. An attacker could potentially exploit this flaw through a denial-of-service attack pattern by rapidly establishing and disconnecting connections to trigger the backlog limit repeatedly, thereby accelerating the rate of memory leakage. This aligns with ATT&CK technique T1499: Endpoint Denial of Service, specifically within the context of resource exhaustion via application layer interactions rather than network flooding alone.
The operational impact is primarily centered on system stability and reliability for NVMe over RDMA deployments. In enterprise environments where high-throughput storage access is critical, such as in cloud infrastructure or high-performance computing clusters, even minor memory leaks can become significant issues if left unpatched. The gradual accumulation of unreleased queue structures increases the kernel's memory footprint unnecessarily, which may lead to increased swap usage, latency spikes due to memory pressure, and ultimately system instability. For systems with limited RAM or those running other critical services concurrently, this vulnerability poses a tangible risk to service continuity.
Mitigation strategies involve applying the upstream Linux kernel patch that corrects the reference counting logic in the nvmet-rdma module. System administrators should ensure their kernels are updated to versions containing this fix. In environments where immediate patching is not feasible, monitoring tools can be configured to track memory usage trends and connection states within the NVMe subsystem to detect abnormal growth patterns indicative of this leak. Additionally, tuning the connect backlog limit parameters may help reduce the frequency with which the vulnerable code path is triggered, although this does not eliminate the underlying defect. Regular auditing of kernel logs for related error messages can also aid in early detection before significant resource depletion occurs.