CVE-2026-93104: RDMA/rvt: Return NULL after port allocation failure
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rvt: Return NULL after port allocation failure
rvtallocdevice() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free.
Return NULL immediately after deallocation so callers can propagate the allocation failure.
Affected Software
Event History
Frequently Asked Questions
When can this flaw be triggered?
It is triggered when rvt_alloc_device() fails to allocate its port array. The function frees the IB device but returns the freed pointer, and callers that treat the non-NULL result as valid can dereference it.
What is the immediate mitigation if an update cannot be applied?
The provided information identifies the failure path but does not specify a configuration workaround. Mitigation requires preventing or correcting the affected allocation-failure handling in rvt_alloc_device().