CVE-2026-98152

Undergoing Analysis Undergoing Analysis - In Progress

nvmet-rdma Queue Leak in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-02

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98152

EUVD

EUVD-2026-86983

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.3
linux	linux_kernel	From 6.12.96 (inc) to 6.12.111 (exc)
linux	linux_kernel	From 6.18.39 (inc) to 6.18.53 (exc)
linux	linux_kernel	From 7.1.4 (inc) to 7.2.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the nvmet-rdma subsystem. When the number of pending disconnecting queues exceeds the backlog limit, the system fails to properly clean up newly allocated queues and their InfiniBand (IB) resources, leading to resource exhaustion.

Detection Guidance

This vulnerability involves leaked queues and IB resources when the nvmet-rdma connect backlog is exceeded. Detection requires monitoring for resource leaks in the kernel, particularly in nvmet-rdma operations. Check kernel logs for errors related to queue allocation failures or resource exhaustion using commands like 'dmesg | grep nvmet_rdma' or 'journalctl -k | grep -i nvmet'. Look for repeated connection drops or IB resource warnings.

Impact Analysis

This vulnerability can cause system instability by depleting available memory and IB resources. It may lead to performance degradation, crashes, or denial of service if exploited repeatedly.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel resource leak in nvmet-rdma functionality. No evidence suggests data exposure or unauthorized access risks that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves the nvmet-rdma queue leak issue. Monitor kernel logs for nvmet-rdma related errors or resource leaks.

Hi! I’m here to help you understand CVE-2026-98152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70