CVE-2026-90415 RDMA/cxgb4: free STAG index when TPT entry write fails
A resource leak in the Linux kernel RDMA driver allows attackers to exhaust STAG indices, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90415?
CVE-2026-90415 is a denial of service vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cxgb4: free STAG index when TPT entry write fails
write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown.
Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.
Which versions are affected by CVE-2026-90415?
How do I fix CVE-2026-90415?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90415 being exploited?
There is no known exploitation of CVE-2026-90415 in the wild and no public exploit code.
Sources
Also known as AZL-102716, BELL-CVE-2026-90415, DEBIAN-CVE-2026-90415, GHSA-v598-vrqp-g6vj, UBUNTU-CVE-2026-90415.