HIGH Introduced in 5.12
nvme-rdma CleanupOrder UAF
CVE-2026-98154
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.
02KernelScan AI Analysis
Risk summary
Systems using NVMe over RDMA storage may experience kernel memory corruption when an RDMA path error occurs during I/O submission. A local process with access to the NVMe-oF block device can trigger this, potentially leading to privilege escalation or system crash. The vulnerability requires the NVMe-oF RDMA driver to be loaded with an active RDMA connection configured.
Vulnerability analysis
In the NVMe over RDMA driver, when an RDMA send fails during I/O submission, the error handling path completes the I/O request to the block layer and then continues to clean up command state and DMA mappings for that already-completed request. Because the request may have been freed or reused after completion, this double cleanup can corrupt kernel memory. The fix reorders the cleanup so DMA resources are released before the request is completed, and skips the now-unnecessary command cleanup on the error path. A local process with access to an NVMe over RDMA block device can trigger this when the underlying RDMA connection encounters a path error.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.12 | 5.15.222 | ccf37fff526c |
| 6.1 | 5.12 | 6.1.189 | c2459519b395 |
| 6.12 | 5.12 | 6.12.111 | a41e7fc8d244 |
| 6.18 | 5.12 | 6.18.53 | cf3e706963ff |
| 6.6 | 5.12 | 6.6.158 | 965804b20c0f |
| 7.2 | 5.12 | 7.2.7 | 171b993a4aed |
| mainline | 5.12 | 7.3 | d61828199c6c |
| cip/6.1 | 5.12 | 6.1.189-cip61 | c2459519b395 |
| cip/6.1-rt | 5.12 | 6.1.189-cip61-rt32 | c2459519b395 |
| cip/6.12 | 5.12 | 6.12.111-cip32 | a41e7fc8d244 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |