CVE-2026-93102

What it actually does

Failure to call hfi1_free_rx during error teardown in hfi1_init_dd leads to leakage of netdev_rx structures and associated dummy netdev objects allocated for AIP/VNIC RX support.

Why it matters to the business

Repeated device initialization failures on affected systems can gradually exhaust kernel memory, potentially leading to reduced stability or denial of service in high-speed RDMA environments over time.

How an attack unfolds

An attacker would need local access to repeatedly trigger device probe or registration failures; the flaw is an error-handling omission rather than an attacker-controlled code path, making remote exploitation infeasible.

How to fix it

Update to a kernel containing the fix that ensures hfi1_free_rx is invoked after IB unregistration and before postinit_cleanup on all failure paths.

How to confirm the fix worked

Review kernel source for the corrected call sequence in init_one teardown; monitor for absence of netdev_rx leaks via kmemleak or slabinfo after simulated init failures.

Typical attack path

1. Obtain local access to trigger repeated hfi1 device initialization attempts
2. Force failure in hfi1_init or hfi1_register_ib_device after RX allocation
3. Observe resource accumulation without explicit triggering of the leak

How to detect it

Search kernel logs for repeated hfi1 init failures; inspect slabinfo or kmemleak reports for persistent netdev_rx and dummy netdev allocations after device removal attempts.

What your security team should do

• Prioritize kernel updates for systems using hfi1 RDMA hardware
• Enable kmemleak or similar leak detectors in test environments to validate fixes
• Restrict unprivileged local access on critical RDMA nodes until patched