RDMA/mad: Fix receive buffer leak when PKey enforcement fails
Summary
| CVE | CVE-2026-98354 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-06 09:18:28 UTC |
| Updated | 2026-10-19 10:18:38 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs ib_mad_enforce_security() before linking recv_buf onto that list. On failure it calls ib_free_recv_mad(), which only walks rmpp_list and frees the ib_mad_private of every buffer found there. As the list is still empty at that point, nothing is freed at all. The caller cannot clean up either: ib_mad_recv_done() sets recv to NULL right after ib_mad_complete_recv() returns, assuming the MAD layer took ownership of the buffer. Every MAD that fails the PKey check therefore leaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA), and a remote node can trigger this repeatedly by sending MADs with a wrong PKey. Link recv_buf onto rmpp_list right after the list is initialized, so the error path has something to free. |
Risk And Classification
EPSS: 0.001720000 probability, percentile 0.059350000 (date 2026-10-06)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 47a2b338fe63200d716d2e24131cdb49f17c77da 4617c9a856188674dddb0ca66979746d07688579 git | Not specified |
| CNA | Linux | Linux | affected 47a2b338fe63200d716d2e24131cdb49f17c77da 8e2036fb47a5b152d53eadbd35abf311bd34cc7f git | Not specified |
| CNA | Linux | Linux | affected 47a2b338fe63200d716d2e24131cdb49f17c77da bad289e42f512646a988f278f536d21547df73f1 git | Not specified |
| CNA | Linux | Linux | affected 47a2b338fe63200d716d2e24131cdb49f17c77da 752b30e9d339008e5ce7eed412e9446078916129 git | Not specified |
| CNA | Linux | Linux | affected 47a2b338fe63200d716d2e24131cdb49f17c77da 39c4ea72a40503e102ae07e6776005f96ca078a6 git | Not specified |
| CNA | Linux | Linux | affected 47a2b338fe63200d716d2e24131cdb49f17c77da 5091e25ec503f7fc02723ca435226467b68caac7 git | Not specified |
| CNA | Linux | Linux | affected 47a2b338fe63200d716d2e24131cdb49f17c77da c0d8df85db146d6275e226cb950023be69dd6c77 git | Not specified |
| CNA | Linux | Linux | affected 47a2b338fe63200d716d2e24131cdb49f17c77da 3476c28c9addfa253f505e6bd87f1f5598b961d0 git | Not specified |
| CNA | Linux | Linux | affected 4.13 | Not specified |
| CNA | Linux | Linux | unaffected 4.13 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.271 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.222 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.189 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.158 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.112 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.54 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.8 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/39c4ea72a40503e102ae07e6776005f96ca078a6 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/4617c9a856188674dddb0ca66979746d07688579 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/752b30e9d339008e5ce7eed412e9446078916129 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/c0d8df85db146d6275e226cb950023be69dd6c77 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/bad289e42f512646a988f278f536d21547df73f1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/8e2036fb47a5b152d53eadbd35abf311bd34cc7f | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/3476c28c9addfa253f505e6bd87f1f5598b961d0 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/5091e25ec503f7fc02723ca435226467b68caac7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.