RDMA/cxgb4: free STAG index when TPT entry write fails

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-90415
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-17 17:17:45 UTC
Updated2026-10-19 09:19:35 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected ec3eead217181d7360a11317a888ceb30807867c 5fe4731bfbd8d83c4a14b4af3a27329969ce8a99 git Not specified
CNA Linux Linux affected ec3eead217181d7360a11317a888ceb30807867c 8f6976d635d190e3d7af7103daaa581cf1ccc12e git Not specified
CNA Linux Linux affected ec3eead217181d7360a11317a888ceb30807867c 9eeafcda1d6c11f0eec532243c4e96ec8c632bd7 git Not specified
CNA Linux Linux affected ec3eead217181d7360a11317a888ceb30807867c 5a21e5114cec4cd3f8a2843d4c46bc49634d6e96 git Not specified
CNA Linux Linux affected ec3eead217181d7360a11317a888ceb30807867c 2f17ca7ab5269ac2504e1039c3921373dccd7712 git Not specified
CNA Linux Linux affected ec3eead217181d7360a11317a888ceb30807867c a2e37d1ab773be3cd26b1c19593ca2dbcece9c57 git Not specified
CNA Linux Linux affected ec3eead217181d7360a11317a888ceb30807867c a64e2beb450179a5d43034af8d5476a11eac1486 git Not specified
CNA Linux Linux affected ec3eead217181d7360a11317a888ceb30807867c fdfb5cea4bf070cdb31d997efd87bb684df041fd git Not specified
CNA Linux Linux affected 3.5 Not specified
CNA Linux Linux unaffected 3.5 semver Not specified
CNA Linux Linux unaffected 5.10.270 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.52 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.6 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report