CVE-2026-90415

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cxgb4: free STAG index when TPT entry write fails

write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and

bumps stats.stag.cur before programming the entry. When

write_adapter_mem() fails, it returns the error without releasing the index

or reversing the statistic. No MR is inserted into rhp->mrs, so

deregistration never reclaims it, leaking the index until device teardown.

Record whether this call allocated the index and, on a failed write, return

it to tpt_table and decrement stats.stag.cur. Key the rollback on both the

write error and that flag, not the error alone: a non-reset update carries

a caller-owned STAG that this call did not allocate and must not free.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References