CVE-2026-93102: RDMA/hfi1: Free RX data on late probe failure
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Free RX data on late probe failure
hfi1initdd() allocates the shared AIP/VNIC RX support before returning. If hfi1init() or hfi1registeribdevice() later fails, initone() tears down the device data without calling hfi1freerx(). This leaks netdevrx and its dummy netdev.
Free the RX support after IB unregistration and before postinitcleanup(), as done on normal device removal.
Affected Software
Event History
Frequently Asked Questions
When does the resource leak occur?
It occurs when shared AIP/VNIC RX support has been allocated during device initialization, but a later hfi1_init() or hfi1_register_ib_device() step fails. The failure teardown previously did not call hfi1_free_rx().
What resources are leaked on the affected failure path?
The affected path leaks netdev_rx and its dummy network device.
Is this triggered during normal device removal?
No. Normal device removal already frees the RX support; the missing cleanup is specific to late probe failures after RX support allocation.