Not yet scoredPublished Aug 28, 2026

CVE-2026-80625RDMA/hns: Fix memory leak of bonding resources

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix memory leak of bonding resources In a corner case of concurrent driver removal and driver reset, bonding resource is first released in hns_roce_hw_v2_exit() during driver removal, and then is allocated again in hns_roce_register_device() during driver reset. This leads to memory leak because the release timing has already passed. This may also lead to a kernel panic as below because of the leaked notifier callback: Call trace: 0xffffa20fccc04978 (P) raw_notifier_call_chain+0x20/0x38 call_netdevice_notifiers_info+0x60/0xb8 netdev_lower_state_changed+0x4c/0xb8 As Sashiko suggested, the teardown order of bonding resources should be inverted to make sure the resources are released when the driver is removed.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 28, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b37ad2e290fc52e575572b04803a4f93f584df6c before bc4caea7a82bbcf94a34eff7094e7f9b501680ab; from b37ad2e290fc52e575572b04803a4f93f584df6c before c0bd03b850d81a8914168d87ddf7f6ffa58875ef	CNA record

References

https://git.kernel.org/stable/c/bc4caea7a82bbcf94a34eff7094e7f9b501680ab
https://git.kernel.org/stable/c/c0bd03b850d81a8914168d87ddf7f6ffa58875ef

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.