CVE-2026-98352

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted

The client borrows shared CQ credits in the ADDR_RESOLVED handler via

ib_cq_pool_get(), before the peer is connected. create_cm() can return

-ERESTARTSYS from wait_event_interruptible_timeout() without destroying

the CM ID. The init_conns() and stop-and-destroy paths then call

destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards

rdma_destroy_id().

CMA serializes the handler against rdma_destroy_id() with handler_mutex,

but that does not order the GET against destroy_con_cq_qp(). If

ADDR_RESOLVED has already passed the DESTROYING check, it can take

con_mutex, GET credits, and then lose the con to kfree. Device

unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup().

Set a per-connection flag under con_mutex before CQ/QP teardown so a

racing ADDR_RESOLVED cannot borrow credits after teardown has begun.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References