CVE-2026-93224

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Fix unmatched rn_unregister on failed accept

When svc_rdma_accept() takes the errout path before

rpcrdma_rn_register() has succeeded, the existing cleanup block

calls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally.

svcxprt_rdma is kzalloc'd, so on that path sc_rn.rn_index is 0 and

sc_rn.rn_done is NULL; the unregister therefore xa_erase()s another

caller's slot 0 and performs an unmatched kref_put() on the

rpcrdma_device's rd_kref.

The same errout also brackets the cleanup with svc_xprt_get()/

svc_xprt_put() around the kref_init() birth reference. The kref

goes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the

net/ns_tracker it pinned) is leaked on every failed accept.

rpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc()

and kref_get() have both succeeded, so rn_done == NULL is a natural

"never registered" sentinel. Guard rpcrdma_rn_unregister() with an

early return

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References