CVE-2026-98352
Received Received - Intake

RDMA rtrs-clt CQ Pool Leak Fix

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDR_RESOLVED handler via ib_cq_pool_get(), before the peer is connected. create_cm() can return -ERESTARTSYS from wait_event_interruptible_timeout() without destroying the CM ID. The init_conns() and stop-and-destroy paths then call destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards rdma_destroy_id(). CMA serializes the handler against rdma_destroy_id() with handler_mutex, but that does not order the GET against destroy_con_cq_qp(). If ADDR_RESOLVED has already passed the DESTROYING check, it can take con_mutex, GET credits, and then lose the con to kfree. Device unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup(). Set a per-connection flag under con_mutex before CQ/QP teardown so a racing ADDR_RESOLVED cannot borrow credits after teardown has begun.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98352
EUVD
EUVD-2026-93337

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux 3b89e92c2a95a39c38a3808f4528e502a39bd94d
Linux Linux 3b89e92c2a95a39c38a3808f4528e502a39bd94d
Linux Linux 3b89e92c2a95a39c38a3808f4528e502a39bd94d
Linux Linux 3b89e92c2a95a39c38a3808f4528e502a39bd94d
Linux Linux 3b89e92c2a95a39c38a3808f4528e502a39bd94d
Linux Linux 3b89e92c2a95a39c38a3808f4528e502a39bd94d
Linux Linux 3b89e92c2a95a39c38a3808f4528e502a39bd94d
Linux Linux 5.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a CQ (Completion Queue) pool leak in the RDMA/rtrs-clt subsystem. When a connection is interrupted, the client borrows shared CQ credits before the peer is connected. If the connection process fails, cleanup routines may destroy resources while the CQ is still in use, leading to a memory leak. A race condition allows the ADDR_RESOLVED handler to borrow credits after teardown begins, causing a warning in ib_cq_pool_cleanup().

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA subsystem and may not have direct detection commands. Monitor kernel logs for CQ pool warnings or errors related to RDMA connections. Check for WARN_ON(cq->cqe_used) messages in system logs.

Impact Analysis

This vulnerability could lead to resource exhaustion on systems using RDMA/rtrs-clt, potentially causing performance degradation or system instability. If exploited, it may trigger kernel warnings or crashes during device unregister operations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update to a kernel version containing the fix for RDMA/rtrs-clt CQ pool leak. Restart affected services after patching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart