Cloudanix VulnDB

CVE-2026-98152

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Sep 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can cause servers handling certain network storage connections to gradually lose track of memory, which may slow down or crash the system under heavy load.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Resource leak of newly allocated nvmet-rdma queues and associated InfiniBand resources occurs when the connect path drops only the device reference after the pending disconnect backlog limit is exceeded.

Why it matters to the business

Systems using RDMA transport for NVMe targets may experience gradual memory and resource exhaustion, leading to degraded performance or denial of service under sustained connection pressure.

How an attack unfolds

A local attacker repeatedly initiates RDMA connections to an nvmet target until the backlog threshold is surpassed, triggering the flawed connect path that leaks queue objects and IB resources without cleanup.

How to fix it

Apply the upstream kernel fix that properly releases the allocated queue and IB resources on backlog-exceeded disconnect paths; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the nvmet-rdma connect handling code for the corrected reference counting and resource release logic; test by reproducing backlog-exceeded connection scenarios and verifying no queue leaks via memory accounting tools.

Typical attack path

  1. Obtain local access on a host interacting with an nvmet-rdma target
  2. Generate a high volume of connection attempts that exceed the configured backlog limit
  3. Trigger pending disconnect conditions to activate the leaky code path
  4. Repeat to accumulate leaked queues and IB resources until system impact occurs

How to detect it

Review kernel logs and RDMA subsystem traces for repeated connection backlog warnings paired with increasing queue allocation counts without corresponding release events; correlate with process activity that opens many RDMA endpoints.

What your security team should do

  • Prioritize kernel updates on all systems exposing nvmet-rdma interfaces
  • Monitor memory and RDMA resource usage on NVMe-oF targets for anomalous growth
  • Restrict local access to hosts that can initiate nvmet-rdma connections where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities