Executive brief
The Linux kernel's NVMe-over-RDMA target implementation has a memory leak when a target is removed while I/O operations are in flight. When the connection is torn down, allocated memory for RDMA contexts and request buffers is not properly freed, gradually consuming system memory and potentially degrading performance or causing denial of service.
Technical details
The vulnerability is a resource leak in the nvmet-rdma module's queue teardown path. When an NVMe target with RDMA transport is removed while I/Os are in flight, responses can be posted but their completion callbacks (nvmet_rdma_send_done and nvmet_rdma_release_rsp) are never invoked before the connection tears down. This causes allocated RDMA read/write contexts and request scatter-gather lists to remain unreleased. The fix involves calling nvmet_rdma_free_rsp_resources() during queue QP teardown to explicitly reclaim memory from in-flight responses. No authentication or user interaction is required; the leak occurs during normal operation when a target is removed.
Affected products
- Linux Linux kernel affected versions unknown
Timeline
- 2026-09-17: disclosed