Cloudanix VulnDB

CVE-2026-90415

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux network driver can waste a limited system resource when certain operations fail, eventually preventing new network memory registrations until the machine is restarted.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

write_tpt_entry allocates an STAG index via c4iw_get_resource and increments stats.stag.cur but fails to release the index or decrement the statistic when write_adapter_mem fails, and because no MR is inserted into rhp->mrs the leak persists until device teardown.

Why it matters to the business

Repeated failures in RDMA memory registration on systems using the cxgb4 driver can gradually exhaust STAG resources, eventually blocking new registrations and degrading or halting RDMA workloads until the device is reset or the system is rebooted.

How an attack unfolds

An attacker with the ability to induce write_adapter_mem failures (for example via crafted RDMA operations or by stressing adapter memory paths) triggers the buggy error path repeatedly, accumulating leaked STAG indices until the resource pool is depleted.

How to fix it

Apply a kernel update that includes the fix recording allocation status and performing rollback on write failure; rebuild and reboot with the corrected RDMA/cxgb4 module.

How to confirm the fix worked

Inspect the patched write_tpt_entry implementation to confirm the allocation flag is set on successful c4iw_get_resource and that both the error path and the flag together trigger tpt_table release and stat decrement.

Typical attack path

  1. Obtain local or RDMA access to a system using the cxgb4 driver
  2. Induce repeated write_tpt_entry failures that exercise the error path
  3. Observe progressive exhaustion of STAG indices over time
  4. Cause denial of new memory region registrations

How to detect it

Review kernel logs and RDMA driver traces for repeated write_adapter_mem or TPT write errors on cxgb4 devices; correlate with increasing stag.cur values without corresponding deregistrations.

What your security team should do

  • Prioritize kernel updates for systems exposing RDMA/cxgb4 interfaces
  • Monitor STAG allocation statistics and RDMA error rates for anomalous growth
  • Restrict untrusted local access to RDMA devices until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.

Affected packages

Ecosystem Package Introduced Fixed