CVE-2026-93151: nvmet-rdma: fix response resource leak on queue teardown
In the Linux kernel, the following vulnerability has been resolved:
nvmet-rdma: fix response resource leak on queue teardown
When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is torn down. As a result nvmetrdmasenddone() and nvmetrdmareleasersp() are never called for the response, and this leaks the allocated RDMA read/write context and request SGLs.
These leaks are recreated by running blktests nvme/061 with the rdma transport and the siw driver. Kernel kmemleak feature reports them as follows:
unreferenced object 0xffff88812bc490c0 (size 32): comm "kworker/2:1H", pid 409, jiffies 4307744490 backtrace (crc 89afd339): kmallocnoprof+0x5f9/0x890 sglallocorder+0x7b/0x380 nvmetreqallocsgls+0x290/0x4f0 [nvmet] nvmetrdmamapsglkeyed+0x241/0x12e0 [nvmetrdma] nvmetrdmahandlecommand+0x73e/0xb80 [nvmetrdma] ibprocesscq+0x149/0x4c0 [ibcore] ibcqpollwork+0x49/0x160 [ibcore] processonework+0x8b2/0x1640 workerthread+0x5fd/0xfe0 kthread+0x367/0x460 retfromfork+0x655/0x9d0 retfromforkasm+0x1a/0x30
unreferenced object 0xffff88814bd05e80 (size 64): comm "kworker/3:1H", pid 148, jiffies 4295195428 backtrace (crc e35510cb): kmallocnoprof+0x5f9/0x890 rdmarwctxinit+0x333/0x1fa0 [ibcore] nvmetrdmamapsglkeyed+0x5c8/0x12e0 [nvmetrdma] nvmetrdmahandlecommand+0x73e/0xb80 [nvmetrdma] ibprocesscq+0x149/0x4c0 [ibcore] ibcqpollwork+0x49/0x160 [ibcore] processonework+0x8b2/0x1640 workerthread+0x5fd/0xfe0 kthread+0x367/0x460 retfromfork+0x655/0x9d0 retfromforkasm+0x1a/0x30
To avoid the memory leaks, reclaim the memory of the in-flight responses when the queue QP is torn down. Call nvmetrdmafreerspresources() that frees up the RDMA read/write context and the request SGLs of such responses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Reclaim the memory of in-flight nvmet-rdma response resources when removing an nvme target with rdma transport while I/Os are in flight, so that nvmet_rdma_send_done() and nvmet_rdma_release_rsp() are reached and the request SGLs/RDMA read/write context are freed (fix described as: "nvmet-rdma: fix response resource leak on queue teardown").
Event History
Frequently Asked Questions
Which systems are exposed to this leak?
Systems acting as an NVMe target using the RDMA transport are exposed when that target is removed while I/O operations are still in flight. The issue was reproduced with the RDMA transport and the siw driver.
What condition triggers the resource leak?
A response must be posted for an in-flight I/O, and the RDMA connection must then be torn down before its send completion is delivered. In that case the normal response completion and release paths are not called.
What resources are leaked?
The leaked resources are the allocated RDMA read/write context and the request scatter-gather lists (SGLs). Kernel kmemleak can report these as unreferenced allocations.
How can I check whether a system is already affected?
Enable or review kernel kmemleak reporting for unreferenced allocations associated with nvmet_req_alloc_sgls, nvmet_rdma_map_sgl_keyed, and nvmet_rdma_handle_command. The issue can be reproduced using blktests nvme/061 with RDMA transport and the siw driver.