Executive brief
The Linux kernel's RDMA cxgb4 driver improperly manages debug file system (debugfs) resources when device registration fails. When registration errors occur, debugfs directory entries are not cleaned up and persist in memory even after the associated device structure is freed, causing a resource leak that wastes kernel memory.
Technical details
The vulnerability is a resource leak (CWE-401) in the RDMA/cxgb4 driver's device deallocation path. The c4iw_alloc() function creates a per-device debugfs tree via setup_debugfs(), but debugfs_remove_recursive() was only called in c4iw_remove(), not in c4iw_dealloc(). When RDMA device registration fails, the error handler calls c4iw_dealloc() directly via the err_dealloc_ctx path, bypassing c4iw_remove(), leaving debugfs dentries allocated and referencing freed memory. The fix moves debugfs_remove_recursive() into c4iw_dealloc() to ensure cleanup occurs regardless of which deallocation path is taken. This is a local kernel memory leak with no network attack vector; impact is limited to resource exhaustion on systems where RDMA device registration repeatedly fails.
Affected products
- Linux Linux Kernel multiple versions (cxgb4 RDMA driver affected)
Timeline
- 2026-09-17: disclosed
- 2026-08-06: patched: Patch authored by Fan Wu