CVE-2026-100075

A flaw was found in the Linux kernel's SCSI Remote Direct Memory Access Protocol (SRP) target driver. When memory allocation fails while processing multi-buffer descriptors, the error-handling routine fails to reset internal tracking counters and leaves an invalid memory pointer. A remote client could exploit this flaw during error recovery, leading to send queue accounting errors and causing a Denial of Service (DoS) through system instability or a kernel crash.

A flaw of moderate impact was found in the Linux kernel's SCSI RDMA Protocol (SRP) target driver (ib_srpt). This flaw affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS 2, and the Red Hat Enterprise Linux CoreOS (RHCOS) images used by several OpenShift Container Platform streams. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream.

When a memory allocation fails while the SRP target processes a multi-buffer indirect descriptor, the error-unwind path of srpt_alloc_rw_ctxs() destroys the RDMA contexts but leaves stale n_rw_ctx and n_rdma counters and a dangling rw_ctxs pointer. A remote client with access to the RDMA fabric and an SRP target session can exploit this condition during error recovery: the stale counters later cause the sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() to subtract the wrong number of send queue credits, which can stall I/O processing or crash the kernel, resulting in a denial of service. Exploitation requires inducing an allocation failure partway through a multi-buffer request, which limits its practicality, and the available evidence demonstrates no impact to confidentiality or integrity.

Red Hat has rated this flaw MODERATE (CVSS 3.1 base score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs significantly from the upstream CVE record's CRITICAL rating (CVSS 3.1 base score 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The Red Hat rating reflects that exploitation requires access to the RDMA fabric and an established SRP target session, depends on triggering an allocation failure, and impacts availability only.

The upstream fix resets the n_rw_ctx and n_rdma counters and clears the rw_ctxs pointer on the unwind path before returning an error. Red Hat has deferred applying this fix to the affected streams given the moderate severity rating and the narrow exploitation conditions; the residual risk is a potential denial of service limited to systems that expose an SRP target over an RDMA fabric.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.