CVE-2026-93277

Received Received - Intake

RDMA Resource Leak in Linux Kernel

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserves the uobject and allows the destroy callback to run again, even though the driver resource has already been freed. Call ib_no_udata_io() before teardown so udata failures are detected while the resource is still intact, then return success after teardown completes. As part of this change, move ib_respond_empty_udata() to the start of the create and modify flows. While this is not strictly required for general create flows, as the core layer unwinds uobjects on failure, it is necessary for create AH. In _rdma_create_ah(), the HW object is otherwise leaked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-09-25

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-93277

EUVD

EUVD-2026-86149

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of udata in RDMA/bnxt_re driver destroy callbacks. The issue occurs when userspace access fails, causing the destroy callback to run again after driver resources are already freed. The fix validates udata before executing commands and ensures proper cleanup to prevent resource leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/bnxt_re driver. Detection requires checking kernel logs for related errors or kernel crashes involving the bnxt_re module. Commands like dmesg | grep bnxt_re or journalctl -k | grep bnxt_re may help identify issues.

Impact Analysis

This vulnerability could lead to system instability or crashes due to double-free of driver resources. It may also cause resource leaks, potentially allowing unauthorized access or denial-of-service conditions in systems using the affected RDMA/bnxt_re driver.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue related to RDMA resource management that could lead to resource leaks or use-after-free scenarios, but no evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel updates from your distribution and apply them promptly. If immediate patching is not possible, consider disabling the bnxt_re module if it is not in use.

Hi! I’m here to help you understand CVE-2026-93277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70