CVE-2026-93153 RDMA/bng_re: return a timeout when firmware responses stall
A flaw in the Linux kernel RDMA driver causes an infinite loop when firmware responses stall, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93153?
CVE-2026-93153 is a denial of service vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/bng_re: return a timeout when firmware responses stall
__wait_for_resp() documents that it returns a non-zero error when a firmware command does not complete, and bng_re_rcfw_send_message() already marks the firmware as stalled when the helper returns -ENODEV.
However, the helper ignores wait_event_timeout() expiry. If the response slot remains in use after the timeout and after the polled CREQ service attempt, the loop starts another full timeout period and can repeat forever.
Return -ENODEV after a timed out wait that still has no response. The existing caller then marks FIRMWARE_STALL_DETECTED and returns -ETIMEDOUT to the command issuer.
Which versions are affected by CVE-2026-93153?
How do I fix CVE-2026-93153?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-93153 being exploited?
There is no known exploitation of CVE-2026-93153 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93153, GHSA-8mhp-w344-hxg5, UBUNTU-CVE-2026-93153.