CVE-2026-98352
RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
No known exploitation. EPSS puts it in the 6th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 3b89e92c2a95a39c38a3808f4528e502a39bd94d, < a82cca40139d9fcae8208901856bd5bb4051f097Upgrade to: a82cca40139d9fcae8208901856bd5bb4051f097Affected: ≥ 3b89e92c2a95a39c38a3808f4528e502a39bd94d, < 74c4ed55e61f1b65ddbebc5b635d136461a1c3daUpgrade to: 74c4ed55e61f1b65ddbebc5b635d136461a1c3daAffected: ≥ 3b89e92c2a95a39c38a3808f4528e502a39bd94d, < 6f8020fe7465f49e234a576c04e415e9d08c7878Upgrade to: 6f8020fe7465f49e234a576c04e415e9d08c7878Affected: ≥ 3b89e92c2a95a39c38a3808f4528e502a39bd94d, < 31024e158b45358370a0a14ed96589e6aa62d6cbUpgrade to: 31024e158b45358370a0a14ed96589e6aa62d6cb + 3 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDR_RESOLVED handler via ib_cq_pool_get(), before the peer is connected. create_cm() can return -ERESTARTSYS from wait_event_interruptible_timeout() without destroying the CM ID. The init_conns() and stop-and-destroy paths then call destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards rdma_destroy_id(). CMA serializes the handler against rdma_destroy_id() with handler_mutex, but that does not order the GET against destroy_con_cq_qp(). If ADDR_RESOLVED has already passed the DESTROYING check, it can take con_mutex, GET credits, and then lose the con to kfree. Device unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup(). Set a per-connection flag under con_mutex before CQ/QP teardown so a racing ADDR_RESOLVED cannot borrow credits after teardown has begun.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 6th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda
- git.kernel.org/stable/c/31024e158b45358370a0a14ed96589e6aa62d6cb
- git.kernel.org/stable/c/6f8020fe7465f49e234a576c04e415e9d08c7878
And 4 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI