CVE-2026-93151

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvmet-rdma: fix response resource leak on queue teardown

When an nvme target with rdma transport is removed while I/Os are in

flight, a response can be posted but its send completion is never

delivered before the connection is torn down. As a result

nvmet_rdma_send_done() and nvmet_rdma_release_rsp() are never called for

the response, and this leaks the allocated RDMA read/write context and

request SGLs.

These leaks are recreated by running blktests nvme/061 with the rdma

transport and the siw driver. Kernel kmemleak feature reports them as

follows:

unreferenced object 0xffff88812bc490c0 (size 32):

comm "kworker/2:1H", pid 409, jiffies 4307744490

backtrace (crc 89afd339):

__kmalloc_noprof+0x5f9/0x890

sgl_alloc_order+0x7b/0x380

nvmet_req_alloc_sgls+0x290/0x4f0 [nvmet]

nvmet_rdma_map_sgl_keyed+0x241/0x12e0 [nvmet_rdma]

nvmet_rdma_handle_command+0x73e/0xb80 [nvmet_rdma]

__

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References