Not yet scoredPublished Sep 17, 2026

CVE-2026-90415RDMA/cxgb4: free STAG index when TPT entry write fails

Updated under an hour ago (Oct 27, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ec3eead217181d7360a11317a888ceb30807867c before 5fe4731bfbd8d83c4a14b4af3a27329969ce8a99; from ec3eead217181d7360a11317a888ceb30807867c before 8f6976d635d190e3d7af7103daaa581cf1ccc12e; from ec3eead217181d7360a11317a888ceb30807867c before 9eeafcda1d6c11f0eec532243c4e96ec8c632bd7; from ec3eead217181d7360a11317a888ceb30807867c before 5a21e5114cec4cd3f8a2843d4c46bc49634d6e96; from ec3eead217181d7360a11317a888ceb30807867c before 2f17ca7ab5269ac2504e1039c3921373dccd7712; from ec3eead217181d7360a11317a888ceb30807867c before a2e37d1ab773be3cd26b1c19593ca2dbcece9c57; from ec3eead217181d7360a11317a888ceb30807867c before a64e2beb450179a5d43034af8d5476a11eac1486; from ec3eead217181d7360a11317a888ceb30807867c before fdfb5cea4bf070cdb31d997efd87bb684df041fd	CNA record

References

References

https://git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99
https://git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e
https://git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7
https://git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96
https://git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712
https://git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57
https://git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486
https://git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.