CVE-2026-93104

A flaw was found in the Linux kernel (RDMA/rvt component). The rvt_alloc_device() function incorrectly returns a pointer to memory that has already been deallocated after a port allocation failure. This allows callers to dereference the freed memory, leading to a use-after-free vulnerability. This issue can result in system instability, denial of service, or potentially arbitrary code execution.

rvt_alloc_device can deallocate the IB device after a port array allocation failure but still return the released pointer to callers. Callers treat any non NULL result as a valid rvt_dev_info object and may dereference freed memory, which creates an explicit use after free in the RDMA rdmavt initialization path. For the CVSS the PR:L in the paranoid score reflects a local user influence scenario where an attacker can create memory pressure or otherwise race driver initialization in an environment where RDMA device setup is performed by system services. The issue is not network reachable because it is triggered through local driver allocation and initialization failure handling rather than RDMA packet processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.