Executive brief
The Linux kernel's RDMA/rvt (RDMA Verbs Transport) subsystem has a memory management flaw in its device initialization code. When allocating a new RDMA device fails due to insufficient memory for port structures, the kernel incorrectly returns a freed memory pointer instead of a null value. This allows callers to dereference the freed memory, potentially leading to system crashes or privilege escalation in environments using high-speed RDMA networking hardware.
Technical details
The vulnerability is a use-after-free flaw in the rvt_alloc_device() function within drivers/infiniband/sw/rdmavt/vt.c. When kzalloc_objs() fails to allocate memory for the port array, the code calls ib_dealloc_device() to free the IB device structure but then returns the pointer to the freed memory instead of NULL. Callers expecting NULL on failure treat the non-NULL return value as valid and dereference it, causing a use-after-free. The attack vector is local; exploitation requires the ability to trigger device allocation failure through memory exhaustion. The fix adds an explicit return NULL statement after deallocation. Patches were committed on 2026-07-13 in the upstream kernel and backported to stable trees (e.g., commit b1e1b25723af44328524c7b54433e4bf0ab9930c on 2026-09-14).
Affected products
- Linux Linux kernel Versions containing commit ff6acd69518e ("IB/rdmavt: Add device structure allocation") and prior to fix commit 2982eaf3b9d2d953318c74cd6f1b7576ea6d7b1f
Timeline
- 2026-09-17: disclosed: CVE-2026-93104 published on NVD
- 2026-07-13: patched: Fix committed upstream by Leon Romanovsky
- 2026-09-14: patched: Backported to stable kernel trees