Critical 9.8Published Sep 25, 2026

CVE-2026-100075RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

Updated under an hour ago (Oct 28, 2026, 7:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 before af00051dbc9f467d4840ec709680660a3f8990fa; from b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 before 717ab4d0614e9446bf8e2de6229464499e4008d6; from b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 before f1f2252da52cdda912da9993f39f58783b01b38f; from b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 before f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d; from b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 before be1478849e1abb1e12dc12e14cdbf800cc6fa99a; from b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 before af073bd245180393bcb15d33d3990a6bdc32593a; from b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 before bd02d644bd19a2795c018635d273d91e45d2bb95; from b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 before b38f98e176050850f41bb6415f3a71400056623e	CNA record
linux linux_kernel linux:linux_kernel	from 4.7 before 5.10.270; from 5.11 before 5.15.221; from 5.16 before 6.1.188; from 6.2 before 6.6.157; from 6.7 before 6.12.110; from 6.13 before 6.18.52; from 6.19 before 7.2.6	NVD

References

References

https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa	patch
https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6	patch
https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f	patch
https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d	patch
https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a	patch
https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a	patch
https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95	patch
https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.