CVE-2026-89531: svcrdma: Reject connection when transport allocation fails
In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Reject connection when transport allocation fails
handleconnectreq() returns without action when svcrdmacreatexprt() fails to allocate the new transport. The CM core returns 0 for CONNECTREQUEST events, so it does not destroy the new rdmacmid. Each allocation failure under memory pressure leaks one rdmacmid, and a remote peer driving connection attempts can amplify this.
Reject the connection by returning a non-zero status from the CM event handler, which tells the CM core to destroy the orphaned cmid.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's svcrdma connection handling are exposed when they accept RDMA connection requests and transport allocation can fail under memory pressure. A remote peer can amplify the leak by repeatedly initiating connection attempts during those allocation failures.
What does an attacker need to trigger the leak?
The attacker needs to be able to send RDMA connection requests to the affected system. Exploitation also depends on causing or coinciding with failures to allocate a new transport, such as during memory pressure.