{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100075", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.456Z", "datePublished": "2026-09-25T13:06:47.399Z", "dateUpdated": "2026-09-25T14:41:03.253Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T14:41:03.253Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb->desc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator's SRP_CMD IU. The path is srpt_recv_done->srpt_handle_new_iu->srpt_handle_cmd->srpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db->len=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i>=1 every time, leaving n_rw_ctx>=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target's administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host's kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd's release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree'd rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx->sg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/ulp/srpt/ib_srpt.c"], "versions": [{"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa", "status": "affected", "versionType": "git"}, {"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6", "status": "affected", "versionType": "git"}, {"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f", "status": "affected", "versionType": "git"}, {"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d", "status": "affected", "versionType": "git"}, {"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a", "status": "affected", "versionType": "git"}, {"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a", "status": "affected", "versionType": "git"}, {"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95", "status": "affected", "versionType": "git"}, {"version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "lessThan": "b38f98e176050850f41bb6415f3a71400056623e", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/ulp/srpt/ib_srpt.c"], "versions": [{"version": "4.7", "status": "affected"}, {"version": "0", "lessThan": "4.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.7", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"}, {"url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"}, {"url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"}, {"url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"}, {"url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"}, {"url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"}, {"url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"}, {"url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"}], "title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/ulp/srpt/ib_srpt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa", "status": "affected", "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "versionType": "git"}, {"lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6", "status": "affected", "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "versionType": "git"}, {"lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f", "status": "affected", "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "versionType": "git"}, {"lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d", "status": "affected", "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "versionType": "git"}, {"lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a", "status": "affected", "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "versionType": "git"}, {"lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a", "status": "affected", "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "versionType": "git"}, {"lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95", "status": "affected", "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "versionType": "git"}, {"lessThan": "b38f98e176050850f41bb6415f3a71400056623e", "status": "affected", "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/ulp/srpt/ib_srpt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.7"}, {"lessThan": "4.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."}], "id": "CVE-2026-100075", "lastModified": "2026-09-25T14:17:14.163", "metrics": {}, "published": "2026-09-25T14:17:14.163", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}