CVE-2026-98154
Linux kernel: double free
- Risk score
- 52/100
- CVSS
- 7.0 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap a…
- Affected
- Linux kernel
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.0 high
- On your watchlist: linux kernel
References
- https://git.kernel.org/stable/c/171b993a4aed9889159df4815b6a6ba141e61975
- https://git.kernel.org/stable/c/965804b20c0f02c1a6cf4b69c0498a79e56f97fe
- https://git.kernel.org/stable/c/a41e7fc8d244d9cfc6273051aed85b67adedbb89
- https://git.kernel.org/stable/c/c2459519b39587c9c27d6b8a8cf516fee10fce66
- https://git.kernel.org/stable/c/ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bb
- https://git.kernel.org/stable/c/cf3e706963ffbd3ee2568fa0d08ab016f0575ea8
- https://git.kernel.org/stable/c/d61828199c6cb4b76d48403c77023cd4bb9d09fc
Original description
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.
Last activity 25 Sep 2026. Patch Forecast updates every hour.