All vulnerabilities
CVE-2026-97477

Linux: RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2aAlso 1bcdeddddffadff9993657f6b0e5535d66ebd10f, 4fbc8230009f5b1bcd13cc74c5a6a43ddba141fdCVE List
Published24 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2aLinuxCVE List
  • 1bcdeddddffadff9993657f6b0e5535d66ebd10fLinuxCVE List
  • 4fbc8230009f5b1bcd13cc74c5a6a43ddba141fdLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()

When __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path jumps to err_mode which frees the counter without decrementing port_counter->num_counters. The only place that decrements is rdma_counter_free(), which is unreachable since the counter was never successfully bound.

This leak accumulates across repeated failures, permanently preventing the port from switching to AUTO mode (-EBUSY in __counter_set_mode()) and blocking the MANUAL→NONE auto-revert in rdma_counter_free(). When the mode was NONE before the call, the MANUAL mode set by __counter_set_mode() also leaks since the revert logic is never reached.

Add an err_bind label between the num_counters increment and the existing err_mode label. It decrements num_counters and mirrors the MANUAL→NONE revert from rdma_counter_free(), ensuring the port state is fully restored on bind failure.

Text from CVE List

Affected versions 10

  • Linuxaffected: 8bc205eff3056a9ed3850937cdd2192f05e6d3cb before 7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2aCVE List
  • Linuxaffected: 8bc205eff3056a9ed3850937cdd2192f05e6d3cb before 1bcdeddddffadff9993657f6b0e5535d66ebd10fCVE List
  • Linuxaffected: 8bc205eff3056a9ed3850937cdd2192f05e6d3cb before da95cb016812c0e012ea839f191926e35ca8f57fCVE List
  • Linuxaffected: 8bc205eff3056a9ed3850937cdd2192f05e6d3cb before 4fbc8230009f5b1bcd13cc74c5a6a43ddba141fdCVE List
  • Linuxaffected: 5.11CVE List
  • Linuxunaffected: all versions before 5.11CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4