CVE-2026-93224

A flaw was found in the Linux kernel. This vulnerability can lead to a Denial of Service (DoS) due to improper error handling during connection cleanup in the Remote Direct Memory Access (RDMA) server subsystem. When a connection accept operation fails before registration completes, the kernel unconditionally unregisters uninitialized transport resources. A remote attacker could exploit this flaw by triggering connection accept failures, leading to reference count corruption, memory leaks, and potential system crashes.

An error path in svc_rdma_accept() can call rpcrdma_rn_unregister() before the removal notification was registered. Because the notification structure is zero initialized, the unmatched unregister can erase slot 0 belonging to another caller and perform an unmatched kref_put() on the shared rpcrdma_device. A premature final reference drop can create a use after free candidate while other notification users still retain references, and the same failed accept path also leaks the svcxprt_rdma transport and its pinned network namespace state. A remote RPC over RDMA peer may reach the accept path through the adjacent RDMA fabric, although reliable triggering requires an early accept or registration failure and therefore AC:H. For the CVSS the PR:N value is used because the peer needs network access to the RDMA service but does not need a local account or privileges on the target. Impact is at least denial of service and may include confidentiality or integrity impact if the reference count error produces exploitable memory reuse. The paranoid score uses C:H/I:H/A:H because the bug can corrupt shared notification ownership and prematurely release a referenced kernel object.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.