Executive brief
The Linux kernel's RDMA transport service (svcrdma) contains a resource leak in its connection handler. When memory allocation fails during connection setup, the kernel fails to properly clean up RDMA connection resources. An attacker could trigger repeated connection attempts under memory pressure to exhaust available RDMA resources, potentially causing denial of service or system instability.
Technical details
The vulnerability is a resource leak in the svcrdma (SUNRPC RDMA) transport service located in net/sunrpc/xprtrdma/svc_rdma_transport.c. The handle_connect_req() function fails to properly reject a connection when svc_rdma_create_xprt() cannot allocate a new transport structure due to memory pressure. Because the function previously returned void and the connection manager core does not destroy the rdma_cm_id when a CONNECT_REQUEST handler returns 0, each allocation failure leaks one rdma_cm_id resource. The fix changes handle_connect_req() to return an integer status code (0 for success, 1 for allocation failure), allowing the connection manager to properly clean up the orphaned connection ID when allocation fails. A remote peer can amplify this leak by driving repeated connection attempts.
Affected products
- Linux Linux kernel multiple versions (patch available in stable trees)
Timeline
- 2026-09-11: disclosed: CVE-2026-89531 published
- 2026-05-27: patched: Fix committed to kernel.org
- 2026-09-07: patched: Fix included in stable release