CVE-2026-93037: RDMA/hfi1: Propagate sdma_txinit_ahg() errors
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Propagate sdmatxinitahg() errors
settxreqheaderahg() ignores the return value of sdmatxinitahg().
If sdmatxinitahg() fails, it returns before initializing tx->txreq. However, settxreqheaderahg() ignores the error and returns the AHG change count, causing the caller to continue processing the request as though initialization had succeeded.
Propagate sdmatxinitahg() failures to the caller and abort request processing when initialization fails.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected Software
Event History
Frequently Asked Questions
What condition is required to reach the vulnerable behavior?
The SDMA transmit initialization routine, sdma_txinit_ahg(), must fail while processing an hfi1 request. The available information does not specify what causes that initialization failure or whether it can be triggered remotely.
What happens after the initialization failure in affected code?
The request can continue to be processed even though tx->txreq was not initialized. The fix propagates the failure to the caller and aborts processing of that request instead.