CVE-2026-100075 (GCVE-0-2026-100075)
Vulnerability from cvelistv5
Published
2026-09-25 13:06
Modified
2026-10-19 08:43
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.
References
Impacted products
Vendor Product Version
Linux Linux Version: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2
Version: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2
Version: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2
Version: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2
Version: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2
Version: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2
Version: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2
Version: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb-\u003edesc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator\u0027s SRP_CMD IU. The path is srpt_recv_done-\u003esrpt_handle_new_iu-\u003esrpt_handle_cmd-\u003esrpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db-\u003elen=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i\u003e=1 every time, leaving n_rw_ctx\u003e=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target\u0027s administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host\u0027s kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd\u0027s release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree\u0027d rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx-\u003esg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:43:07.444Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
        },
        {
          "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
        },
        {
          "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
        },
        {
          "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
        }
      ],
      "title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-100075",
    "datePublished": "2026-09-25T13:06:47.399Z",
    "dateReserved": "2026-09-25T10:25:14.456Z",
    "dateUpdated": "2026-10-19T08:43:07.444Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.