CVE-2026-90417: RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: Fix deregskb leak and double free in writetptentry()
When the device is in the fatal error state, writetptentry() returns -EIO before handing the caller's preallocated skb to the transmit path; its allocation-failure returns do the same. c4iwderegmr() ignores the error and frees mhp, leaking mhp->deregskb. c4iwgetdmamr() instead frees the skb a second time after deregmem() already consumed it, a double free.
Make writetptentry() the sole owner of a non-NULL skb, freeing it on every return preceding handoff to c4iwofldsend(): fatal error, tpt and stag allocation failure. c4iwofldsend() consumes the skb on success and error alike, so drop the redundant kfreeskb() in c4iwgetdmamr() after deregmem().
Affected Software
Event History
Frequently Asked Questions
What conditions trigger the memory-management errors?
The errors occur when write_tpt_entry() returns before handing a caller-provided skb to c4iw_ofld_send(), including when the device is in a fatal error state or when TPT or STAG allocation fails.
Which paths are affected by each issue?
c4iw_dereg_mr() can leak mhp->dereg_skb because it ignores the error from write_tpt_entry() and frees mhp. c4iw_get_dma_mr() can double-free the skb after dereg_mem() has already consumed it.
What is the relevant mitigation in the resolved change?
Ensure write_tpt_entry() frees any non-NULL skb on every return before transmission handoff, and remove the redundant kfree_skb() in c4iw_get_dma_mr() after dereg_mem().