CVE-2026-100075

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d 416baaa9-dc9f-4396-8d5f-8c081fb06d67

The full cvelistV5 record. Download as CVE-2026-100075.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "af00051dbc9f467d4840ec709680660a3f8990fa",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "717ab4d0614e9446bf8e2de6229464499e4008d6",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f1f2252da52cdda912da9993f39f58783b01b38f",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "be1478849e1abb1e12dc12e14cdbf800cc6fa99a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "af073bd245180393bcb15d33d3990a6bdc32593a",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "bd02d644bd19a2795c018635d273d91e45d2bb95",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            },
            {
              "lessThan": "b38f98e176050850f41bb6415f3a71400056623e",
              "status": "affected",
              "version": "b99f8e4d7bcd3bfbb3cd965918523299370d0cb2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/srpt/ib_srpt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters\n\nWhen srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect\ndescriptor, the unwind path destroys RDMA contexts but leaves stale\nn_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later\nsq_wr_avail accounting in srpt_queue_response() or srpt_write_pending()\ncan then subtract the wrong number of send queue credits.\n\nReset the counters and clear rw_ctxs after freeing the heap\nallocation before returning an error."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The descriptor table that makes srpt_alloc_rw_ctxs() fail partway (idb->desc_list entries, table_desc.len, data_out/in_desc_cnt) comes in a remote initiator's SRP_CMD IU. The path is srpt_recv_done->srpt_handle_new_iu->srpt_handle_cmd->srpt_get_desc_tbl, and srpt also accepts logins through its RDMA-CM listener, which runs over routable RoCEv2 (UDP/IP).\nAC:L - The initiator picks the failure point: a small first descriptor followed by one with db->len=0xFFFFFFFF, whose scatterlist array is too big for sgl_alloc_order() to allocate. target_alloc_sgl() then fails at i>=1 every time, leaving n_rw_ctx>=1 and a dangling rw_ctxs. No race or outside state is needed.\nPR:N - SRP login (srpt_cm_req_recv) has no authentication. It only compares the initiator port ID that the initiator itself claims against the configured ACL, and the malformed SRP_CMD is parsed right after login.\nUI:N - The initiator sends the malformed SRP_CMD over its own channel, and no action by the target's administrator or any user is needed.\nS:U - The use-after-free and crash happen in the target host's kernel, which is the same security authority that runs ib_srpt. No VM or IOMMU boundary is crossed.\nC:H - In kernels from v4.7 up to v5.1, srpt_handle_cmd's release_ioctx path calls srpt_release_cmd(). Because n_rw_ctx is stale, srpt_free_rw_ctxs() reads the kfree'd rw_ctxs array, a use-after-free on a slab object the attacker can reclaim.\nI:H - The same srpt_free_rw_ctxs() pass calls rdma_rw_ctx_destroy() and target_free_sgl() again on ctx->sg lists the unwind loop already freed. That is a double free of the scatterlists and their data pages, a memory-corruption primitive.\nA:H - Each malformed SRP_CMD can be repeated at will and corrupts the heap (UAF plus double free) on older kernels. On newer kernels the busy path reached after this failure crashes the target, so any initiator can repeatedly take down the SRP target host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:03.253Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d"
        },
        {
          "url": "https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a"
        },
        {
          "url": "https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95"
        },
        {
          "url": "https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e"
        }
      ],
      "title": "RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-100075",
    "datePublished": "2026-09-25T13:06:47.399Z",
    "dateReserved": "2026-09-25T10:25:14.456Z",
    "dateUpdated": "2026-09-25T14:41:03.253Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}