All vulnerabilities
CVE-2026-98354

Linux: RDMA/mad: Fix receive buffer leak when PKey enforcement fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4617c9a856188674dddb0ca66979746d07688579Also 8e2036fb47a5b152d53eadbd35abf311bd34cc7f, 752b30e9d339008e5ce7eed412e9446078916129 and 3 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4617c9a856188674dddb0ca66979746d07688579LinuxCVE List
  • 8e2036fb47a5b152d53eadbd35abf311bd34cc7fLinuxCVE List
  • 752b30e9d339008e5ce7eed412e9446078916129LinuxCVE List
  • 39c4ea72a40503e102ae07e6776005f96ca078a6LinuxCVE List
  • 5091e25ec503f7fc02723ca435226467b68caac7LinuxCVE List
  • 3476c28c9addfa253f505e6bd87f1f5598b961d0LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mad: Fix receive buffer leak when PKey enforcement fails

ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs ib_mad_enforce_security() before linking recv_buf onto that list. On failure it calls ib_free_recv_mad(), which only walks rmpp_list and frees the ib_mad_private of every buffer found there. As the list is still empty at that point, nothing is freed at all.

The caller cannot clean up either: ib_mad_recv_done() sets recv to NULL right after ib_mad_complete_recv() returns, assuming the MAD layer took ownership of the buffer. Every MAD that fails the PKey check therefore leaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA), and a remote node can trigger this repeatedly by sending MADs with a wrong PKey.

Link recv_buf onto rmpp_list right after the list is initialized, so the error path has something to free.

Text from CVE List

Affected versions 18

  • Linuxaffected: 47a2b338fe63200d716d2e24131cdb49f17c77da before 4617c9a856188674dddb0ca66979746d07688579CVE List
  • Linuxaffected: 47a2b338fe63200d716d2e24131cdb49f17c77da before 8e2036fb47a5b152d53eadbd35abf311bd34cc7fCVE List
  • Linuxaffected: 47a2b338fe63200d716d2e24131cdb49f17c77da before bad289e42f512646a988f278f536d21547df73f1CVE List
  • Linuxaffected: 47a2b338fe63200d716d2e24131cdb49f17c77da before 752b30e9d339008e5ce7eed412e9446078916129CVE List
  • Linuxaffected: 47a2b338fe63200d716d2e24131cdb49f17c77da before 39c4ea72a40503e102ae07e6776005f96ca078a6CVE List
  • Linuxaffected: 47a2b338fe63200d716d2e24131cdb49f17c77da before 5091e25ec503f7fc02723ca435226467b68caac7CVE List
  • Linuxaffected: 47a2b338fe63200d716d2e24131cdb49f17c77da before c0d8df85db146d6275e226cb950023be69dd6c77CVE List
  • Linuxaffected: 47a2b338fe63200d716d2e24131cdb49f17c77da before 3476c28c9addfa253f505e6bd87f1f5598b961d0CVE List
  • Linuxaffected: 4.13CVE List
  • Linuxunaffected: all versions before 4.13CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8