CVE-2026-92488: RDMA/erdma: complete object teardown when the destroy command fails
In the Linux kernel, the following vulnerability has been resolved:
RDMA/erdma: complete object teardown when the destroy command fails
erdmadestroyqp(), erdmadestroycq(), erdmaderegmr(), and erdmadestroyah() returned early when erdmapostcmdwait() failed, leaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN identifiers. A command timeout clears ERDMACMDQSTATEOKBIT and permanently disables the command queue, so no retry can succeed; the RDMA core keeps the object after a failed destructor and forced uverbs cleanup then nulls the pointers, making the resources unreachable.
Warn on failure but release every software-owned resource and return success, since during terminal destruction the hardware command result is only diagnostic.
Affected Software
Event History
Frequently Asked Questions
What conditions trigger the resource leak?
The leak occurs when erdma_post_cmd_wait() fails during destruction or deregistration of an ERDMA queue pair, completion queue, memory region, or address handle. A command timeout disables the command queue permanently, so retrying the failed command cannot succeed.
What resources can remain allocated after a failed destroy operation?
Affected failure paths can leak queue buffers, MTTs, doorbells, and STAG, QPN, CQN, and AHN identifiers. During forced uverbs cleanup, the associated pointers can be nulled after the failed destructor, leaving those resources unreachable.
Is retrying the destroy command an effective workaround?
No. Once a command timeout clears ERDMA_CMDQ_STATE_OK_BIT, the command queue is permanently disabled and no retry can succeed. The resolved behavior is to warn about the hardware command failure while releasing all software-owned resources and completing terminal destruction.