CVE-2026-93104

What it actually does

The vulnerability is a use-after-free in the Linux kernel RDMA/rvt subsystem: rvt_alloc_device deallocates an IB device on port array allocation failure but returns the now-freed pointer, which callers dereference as if it were valid.

Why it matters to the business

Kernel crashes, potential local privilege escalation, or denial of service on systems that use RDMA networking, leading to downtime in HPC, storage, and high-speed interconnect environments.

How an attack unfolds

An attacker with local access forces an RDMA device allocation to fail at the port-array stage; the function returns a dangling pointer that a caller immediately dereferences, enabling use-after-free exploitation for memory corruption or code execution.

How to fix it

Update the Linux kernel to a version that contains the fix ensuring rvt_alloc_device returns NULL immediately after deallocation on port-allocation failure.

How to confirm the fix worked

Inspect the RDMA/rvt source for the corrected return-NULL path after port allocation failure and confirm the change is present in the running kernel build.

Typical attack path

1. Obtain local unprivileged access on a Linux system with RDMA support
2. Trigger rvt_alloc_device under conditions that cause port-array allocation to fail
3. Cause the returned pointer to be dereferenced by RDMA core or driver code
4. Exploit the resulting use-after-free for kernel memory corruption or privilege escalation

How to detect it

Review kernel logs for RDMA device allocation failures immediately followed by use-after-free oops or panic messages; correlate with process activity that exercises RDMA device creation.

What your security team should do

• Prioritize kernel updates on systems exposing RDMA interfaces
• Apply the upstream fix or distribution backport as soon as available
• Limit untrusted local access to RDMA-capable hardware until patched
• Monitor kernel oops and panic logs for RDMA-related allocation failures