CVE-2026-98354
RDMA/mad: Fix receive buffer leak when PKey enforcement fails
No known exploitation. EPSS puts it in the 6th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < 4617c9a856188674dddb0ca66979746d07688579Upgrade to: 4617c9a856188674dddb0ca66979746d07688579Affected: ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < 8e2036fb47a5b152d53eadbd35abf311bd34cc7fUpgrade to: 8e2036fb47a5b152d53eadbd35abf311bd34cc7fAffected: ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < bad289e42f512646a988f278f536d21547df73f1Upgrade to: bad289e42f512646a988f278f536d21547df73f1Affected: ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < 752b30e9d339008e5ce7eed412e9446078916129Upgrade to: 752b30e9d339008e5ce7eed412e9446078916129 + 4 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs ib_mad_enforce_security() before linking recv_buf onto that list. On failure it calls ib_free_recv_mad(), which only walks rmpp_list and frees the ib_mad_private of every buffer found there. As the list is still empty at that point, nothing is freed at all. The caller cannot clean up either: ib_mad_recv_done() sets recv to NULL right after ib_mad_complete_recv() returns, assuming the MAD layer took ownership of the buffer. Every MAD that fails the PKey check therefore leaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA), and a remote node can trigger this repeatedly by sending MADs with a wrong PKey. Link recv_buf onto rmpp_list right after the list is initialized, so the error path has something to free.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 6th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/4617c9a856188674dddb0ca66979746d07688579
- git.kernel.org/stable/c/8e2036fb47a5b152d53eadbd35abf311bd34cc7f
- git.kernel.org/stable/c/bad289e42f512646a988f278f536d21547df73f1
And 5 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI