Vulnerability-Lookup

GHSA-6WCW-WCGC-6J9R

Vulnerability from github – Published: 2026-09-25 15:31 – Updated: 2026-09-25 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits.

Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-100075"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-25T14:17:14Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error.",
  "id": "GHSA-6wcw-wcgc-6j9r",
  "modified": "2026-09-25T15:31:48Z",
  "published": "2026-09-25T15:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100075"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-100075 (GCVE-0-2026-100075)

Vulnerability from cvelistv5 – Published: 2026-09-25 13:06 – Updated: 2026-09-25 14:41

Title

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/af00051dbc9f467d4…
https://git.kernel.org/stable/c/717ab4d0614e9446b…
https://git.kernel.org/stable/c/f1f2252da52cdda91…
https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa…
https://git.kernel.org/stable/c/be1478849e1abb1e1…
https://git.kernel.org/stable/c/af073bd245180393b…
https://git.kernel.org/stable/c/bd02d644bd19a2795…
https://git.kernel.org/stable/c/b38f98e176050850f…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af00051dbc9f467d4840ec709680660a3f8990fa (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < 717ab4d0614e9446bf8e2de6229464499e4008d6 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f1f2252da52cdda912da9993f39f58783b01b38f (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < be1478849e1abb1e12dc12e14cdbf800cc6fa99a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < af073bd245180393bcb15d33d3990a6bdc32593a (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < bd02d644bd19a2795c018635d273d91e45d2bb95 (git) Affected: b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 , < b38f98e176050850f41bb6415f3a71400056623e (git)
Linux	Linux	Affected: 4.7 Unaffected: 0 , < 4.7 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb-\u003edesc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator\u0027s SRP_CMD IU. The path is srpt_recv_done-\u003esrpt_handle_new_iu-\u003esrpt_handle_cmd-\u003esrpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db-\u003elen=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i\u003e=1 every time, leaving n_rw_ctx\u003e=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target\u0027s administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host\u0027s kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd\u0027s release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree\u0027d rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx-\u003esg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:03.253Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
        },
        {
          "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
        },
        {
          "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
        },
        {
          "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
        }
      ],
      "title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-100075",
    "datePublished": "2026-09-25T13:06:47.399Z",
    "dateReserved": "2026-09-25T10:25:14.456Z",
    "dateUpdated": "2026-09-25T14:41:03.253Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-6WCW-WCGC-6J9R

CVE-2026-100075 (GCVE-0-2026-100075)

Tags

Sightings

Nomenclature

Related by attack behaviour