CVE-2026-90219: RDMA/cxgb4: Free debugfs on registration failure
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Free debugfs on registration failure
c4iwalloc() creates the per-device debugfs tree (dev->debugfsroot via setupdebugfs()), but it is removed only in c4iwremove(), not in c4iwdealloc(). When RDMA device registration fails, the registration worker's errdeallocctx path calls c4iwdealloc() directly, bypassing c4iwremove(), so the debugfs dentries leak and outlive the freed c4iwdev.
Move debugfsremoverecursive() into c4iwdealloc() so every path that frees ctx->dev also removes its debugfs tree.
Affected Software
Event History
Frequently Asked Questions
When can this leak occur?
It occurs when RDMA device registration fails after c4iw_alloc() has created the per-device debugfs tree. The registration failure path calls c4iw_dealloc() directly rather than c4iw_remove().
What is affected by the leaked debugfs entries?
The debugfs dentries can outlive the freed c4iw_dev object, leaving entries associated with freed device state. The issue is specific to the cxgb4 RDMA driver's registration-failure cleanup path.
Is normal device removal sufficient to trigger the issue?
No. Normal removal uses c4iw_remove(), which removes the debugfs tree. The leak results from the registration worker failure path that bypasses c4iw_remove().
What change resolves the cleanup gap?
The fix moves debugfs_remove_recursive() into c4iw_dealloc(), ensuring the debugfs tree is removed on every path that frees ctx->dev, including failed registration.