CVE-2026-100075: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: Fix srptallocrwctxs() unwind counters
When srptallocrwctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale nrwctx and nrdma values (and a dangling rwctxs pointer). Later sqwravail accounting in srptqueueresponse() or srptwritepending() can then subtract the wrong number of send queue credits.
Reset the counters and clear rwctxs after freeing the heap allocation before returning an error.
Affected Software
Event History
Frequently Asked Questions
Under what condition can this flaw be triggered?
It requires srpt_alloc_rw_ctxs() to fail partway through handling a multi-buffer indirect descriptor. The subsequent error-unwind path leaves stale RDMA context counters and a dangling rw_ctxs pointer.
What is the operational impact after the failed allocation?
Later response or pending-write processing can use the stale n_rw_ctx and n_rdma values when accounting for send queue work requests. This can subtract an incorrect number of send queue credits in srpt_queue_response() or srpt_write_pending().
What should be done if this condition is identified?
Apply a kernel update containing the fix. The fix resets the counters and clears rw_ctxs after freeing the heap allocation on the error path.