CVE-2026-98354
kernel: RDMA/mad: Fix receive buffer leak when PKey enforcement fails
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 6, 2026
Updated · October 15, 2026
Description
A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem. A remote attacker can trigger a Denial of Service (DoS) by repeatedly sending Management Datagrams (MADs) containing an invalid partition key (PKey). Because the kernel does not properly track and free allocated receive buffers when partition security validation fails, these packets cause an unreleased memory buildup that can eventually exhaust available system memory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 · Missing Release of Resource after Effective Lifetime