CVE-2026-90417

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()

When the device is in the fatal error state, write_tpt_entry() returns -EIO

before handing the caller's preallocated skb to the transmit path; its

allocation-failure returns do the same. c4iw_dereg_mr() ignores the error

and frees mhp, leaking mhp->dereg_skb. c4iw_get_dma_mr() instead frees the

skb a second time after dereg_mem() already consumed it, a double free.

Make write_tpt_entry() the sole owner of a non-NULL skb, freeing it on

every return preceding handoff to c4iw_ofld_send(): fatal error, tpt and

stag allocation failure. c4iw_ofld_send() consumes the skb on success and

error alike, so drop the redundant kfree_skb() in c4iw_get_dma_mr() after

dereg_mem().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References