Executive brief
A vulnerability in the Linux kernel's InfiniBand driver could allow a local user to cause a resource leak. By triggering specific failures during system calls, an attacker could gradually exhaust system resources, potentially leading to a denial-of-service condition where the system becomes unstable or unresponsive. This affects systems using Mellanox HCA hardware.
Technical details
A resource leak exists in the drivers/infiniband/hw/mthca/mthca_provider.c component of the Linux kernel. The vulnerability is caused by a missing call to mthca_unmap_user_db() within the error handling path of mthca_create_srq() when a system call fails. A local attacker with low privileges can repeatedly trigger this failure path to leak kernel memory or mapping resources, eventually leading to a Denial of Service (DoS). The issue has been resolved by ensuring proper unmapping of user doorbells during SRQ (Shared Receive Queue) creation failures and correcting the teardown order in mthca_destroy_srq().
Affected products
- Linux Linux Kernel 2.6.14 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1
Timeline
- 2026-02-16: patched: Initial patch authored by Jason Gunthorpe
- 2026-03-25: disclosed: CVE published by kernel.org
- 2026-05-29: advisory: NVD enrichment and analysis completed
References
- https://git.kernel.org/stable/c/117942ca43e2e3c3d121faae530989931b7f67e1
- https://git.kernel.org/stable/c/11ac61f4e9b7c48b0dd44661765e5ace3c441aa3
- https://git.kernel.org/stable/c/72fcfd4df46f2ee684c4776664d0cfc6c1746c9a
- https://git.kernel.org/stable/c/972b72d7e2d8fe1400f1c7a8304c282c539b7e02
- https://git.kernel.org/stable/c/d0148965dbca8cc8efa7e3d6e99940487bf661c0
- https://git.kernel.org/stable/c/da8eaa73bc37d004350ba68eb18b6ade8e49db52
- https://git.kernel.org/stable/c/deee46b37ebd8cc5ff810127883fca90f2412a7b