CVE-2026-93103 RDMA/hfi1: Preserve unit 0 on allocation failure
A flaw in the Linux kernel hfi1 driver allows an attacker to cause a denial of service by triggering an allocation failure that corrupts the device unit table.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93103?
CVE-2026-93103 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hfi1: Preserve unit 0 on allocation failure
hfi1_free_devdata() assumes that the device was inserted into the unit table and unconditionally erases dd->unit. If xa_alloc_irq() fails, the zero-initialized unit remains zero, so full cleanup can remove an unrelated device from index 0.
Release only the rdmavt allocation and return immediately while the unit table has not acquired the device.
Which versions are affected by CVE-2026-93103?
How do I fix CVE-2026-93103?
Apply the vendor's patch.
Is CVE-2026-93103 being exploited?
There is no known exploitation of CVE-2026-93103 in the wild and no public exploit code.
Sources
Also known as AZL-102099, BELL-CVE-2026-93103, DEBIAN-CVE-2026-93103, GHSA-jjcw-q5gq-x45h, UBUNTU-CVE-2026-93103.