CVE-2026-90415RDMA/cxgb4: free STAG index when TPT entry write fails
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ec3eead217181d7360a11317a888ceb30807867c before 5fe4731bfbd8d83c4a14b4af3a27329969ce8a99; from ec3eead217181d7360a11317a888ceb30807867c before 8f6976d635d190e3d7af7103daaa581cf1ccc12e; from ec3eead217181d7360a11317a888ceb30807867c before 9eeafcda1d6c11f0eec532243c4e96ec8c632bd7; from ec3eead217181d7360a11317a888ceb30807867c before 5a21e5114cec4cd3f8a2843d4c46bc49634d6e96; from ec3eead217181d7360a11317a888ceb30807867c before 2f17ca7ab5269ac2504e1039c3921373dccd7712; from ec3eead217181d7360a11317a888ceb30807867c before a2e37d1ab773be3cd26b1c19593ca2dbcece9c57; from ec3eead217181d7360a11317a888ceb30807867c before a64e2beb450179a5d43034af8d5476a11eac1486; from ec3eead217181d7360a11317a888ceb30807867c before fdfb5cea4bf070cdb31d997efd87bb684df041fd | CNA record |
References
- https://git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99
- https://git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e
- https://git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7
- https://git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96
- https://git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712
- https://git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57
- https://git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486
- https://git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.