HIGH Introduced in 6.0
erdma DestroyCmd Leak
CVE-2026-92488
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/erdma: complete object teardown when the destroy command fails erdma_destroy_qp(), erdma_destroy_cq(), erdma_dereg_mr(), and erdma_destroy_ah() returned early when erdma_post_cmd_wait() failed, leaking the queue buffers, MTTs, doorbells and the STAG, QPN, CQN and AHN identifiers. A command timeout clears ERDMA_CMDQ_STATE_OK_BIT and permanently disables the command queue, so no retry can succeed; the RDMA core keeps the object after a failed destructor and forced uverbs cleanup then nulls the pointers, making the resources unreachable. Warn on failure but release every software-owned resource and return success, since during terminal destruction the hardware command result is only diagnostic.
02KernelScan AI Analysis
Risk summary
A local user with access to an erdma RDMA device can trigger permanent resource leaks by causing hardware command failures during object destruction. Once the command queue is disabled by a timeout, all subsequent object teardowns leak kernel memory and resource identifiers, which can be repeated to exhaust system memory.
Vulnerability analysis
When a hardware command fails during the destruction of an RDMA queue pair, completion queue, memory region, or address handle, the erdma driver returned early without freeing the associated kernel memory, DMA buffers, and resource identifiers. A command timeout permanently disables the device's command queue, so the leaked resources become permanently unreachable as the RDMA core nulls the object pointers after a failed destructor. The fix changes the destroy routines to log a warning on command failure but proceed with releasing all software-owned resources and return success, treating the hardware command result as diagnostic during terminal teardown. This code path is reachable by any local user with access to the erdma RDMA device through the standard verbs interface, and repeated object creation and destruction after a command failure can drive the system toward memory exhaustion.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.0 | 6.12.110 | 5fcfc988ecf3 |
| 6.18 | 6.0 | 6.18.52 | ce7d205c2646 |
| 6.6 | 6.0 | 6.6.160 | 3886d944b506 |
| 7.2 | 6.0 | 7.2.6 | 334145d683ad |
| mainline | 6.0 | 7.3 | 652befcba956 |
| cip/6.12 | 6.0 | 6.12.111-cip32 | 5fcfc988ecf3 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |