CVE-2026-90417

A flaw was found in the Linux kernel's RDMA/cxgb4 component. When the device enters a fatal error state or experiences an allocation failure within the write_tpt_entry() function, it can lead to a memory leak and a double free vulnerability. A local attacker could potentially exploit this issue to cause a denial of service or, in some scenarios, achieve arbitrary code execution.

A double free and leak issue exists in RDMA/cxgb4 memory registration cleanup. write_tpt_entry can return before handing the caller supplied skb to the transmit path when the device is in fatal error state or when internal allocation fails. One caller can then lose the dereg_skb reference and leak memory, while c4iw_get_dma_mr can later free the same skb again after dereg_mem has already consumed it. For the CVSS the PR:L is used because a local user with access to the RDMA device or verbs interface may be able to exercise memory registration and cleanup paths without full root privileges. The issue is not directly network reachable and normally depends on local RDMA device access plus an error or low resource condition. Impact is at least local denial of service and memory corruption via skb double free, with possible confidentiality or integrity impact in a worst case kernel heap corruption scenario.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.