CVE-2026-98354

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/mad: Fix receive buffer leak when PKey enforcement fails

ib_mad_complete_recv() initializes mad_recv_wc->rmpp_list and then runs

ib_mad_enforce_security() before linking recv_buf onto that list. On

failure it calls ib_free_recv_mad(), which only walks rmpp_list and frees

the ib_mad_private of every buffer found there. As the list is still

empty at that point, nothing is freed at all.

The caller cannot clean up either: ib_mad_recv_done() sets recv to NULL

right after ib_mad_complete_recv() returns, assuming the MAD layer took

ownership of the buffer. Every MAD that fails the PKey check therefore

leaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA),

and a remote node can trigger this repeatedly by sending MADs with a

wrong PKey.

Link recv_buf onto rmpp_list right after the list is initialized, so the

error path has something to free.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References