CVE-2026-98154: nvme-rdma: fix -EIO cleanup order in queue_rq
In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma: fix -EIO cleanup order in queuerq
On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete.
Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel NVMe over RDMA transport are exposed when the RDMA queue request path encounters an -EIO error. The provided information does not identify affected kernel versions or configurations beyond use of nvme-rdma.
What condition triggers the faulty cleanup?
The issue is triggered when the nvme-rdma queue_rq path receives -EIO. In that error path, reporting a host path error completes the request before subsequent command cleanup and SQE DMA unmapping occur.
What is the immediate mitigation if an update cannot be applied?
No workaround is provided in the available data. Reducing or avoiding use of NVMe over RDMA would avoid the affected nvme-rdma request path, but the data does not specify a supported configuration-level mitigation.
How can I determine whether this issue may affect a host?
Check whether the host uses the Linux kernel nvme-rdma driver for NVMe over RDMA. The supplied information does not provide version ranges or a detection signature to determine whether a particular kernel build includes the fix.