Executive brief
The Linux kernel's RDMA cxgb4 driver (used for InfiniBand/RDMA connectivity) contains a memory management bug where socket buffers (skb) are either leaked or freed twice under error conditions. This can lead to kernel memory exhaustion or heap corruption when memory registration operations fail, potentially causing system crashes or allowing kernel code execution.
Technical details
The vulnerability is a memory safety bug (CWE-401 leak and CWE-415 double free) in the RDMA/cxgb4 memory registration code. When write_tpt_entry() encounters a fatal device error, TPT allocation failure, or STAG allocation failure, it returns an error before passing the socket buffer to the transmission path. However, the callers (c4iw_dereg_mr() and c4iw_get_dma_mr()) do not properly clean up these skbs: c4iw_dereg_mr() leaks the buffer, while c4iw_get_dma_mr() frees it a second time after dereg_mem() already consumed it. The fix makes write_tpt_entry() responsible for freeing the skb on error before returning to the caller, preventing both leak and double-free conditions. No special privilege or network access is required—the bug manifests internally when error paths are triggered.
Affected products
- Linux Linux kernel multiple versions through at least 6.18
Timeline
- 2026-09-17: disclosed
- 2026-07-29: patched