CVE-2026-80625

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80625", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.775Z", "datePublished": "2026-08-28T06:48:43.583Z", "dateUpdated": "2026-08-28T06:48:43.583Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-28T06:48:43.583Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix memory leak of bonding resources\n\nIn a corner case of concurrent driver removal and driver reset,\nbonding resource is first released in hns_roce_hw_v2_exit() during\ndriver removal, and then is allocated again in hns_roce_register_device()\nduring driver reset. This leads to memory leak because the release\ntiming has already passed. This may also lead to a kernel panic\nas below because of the leaked notifier callback:\n\nCall trace:\n 0xffffa20fccc04978 (P)\n raw_notifier_call_chain+0x20/0x38\n call_netdevice_notifiers_info+0x60/0xb8\n netdev_lower_state_changed+0x4c/0xb8\n\nAs Sashiko suggested, the teardown order of bonding resources should\nbe inverted to make sure the resources are released when the driver\nis removed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "versions": [{"version": "b37ad2e290fc52e575572b04803a4f93f584df6c", "lessThan": "bc4caea7a82bbcf94a34eff7094e7f9b501680ab", "status": "affected", "versionType": "git"}, {"version": "b37ad2e290fc52e575572b04803a4f93f584df6c", "lessThan": "c0bd03b850d81a8914168d87ddf7f6ffa58875ef", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bc4caea7a82bbcf94a34eff7094e7f9b501680ab"}, {"url": "https://git.kernel.org/stable/c/c0bd03b850d81a8914168d87ddf7f6ffa58875ef"}], "title": "RDMA/hns: Fix memory leak of bonding resources", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bc4caea7a82bbcf94a34eff7094e7f9b501680ab", "status": "affected", "version": "b37ad2e290fc52e575572b04803a4f93f584df6c", "versionType": "git"}, {"lessThan": "c0bd03b850d81a8914168d87ddf7f6ffa58875ef", "status": "affected", "version": "b37ad2e290fc52e575572b04803a4f93f584df6c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/hns/hns_roce_hw_v2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix memory leak of bonding resources\n\nIn a corner case of concurrent driver removal and driver reset,\nbonding resource is first released in hns_roce_hw_v2_exit() during\ndriver removal, and then is allocated again in hns_roce_register_device()\nduring driver reset. This leads to memory leak because the release\ntiming has already passed. This may also lead to a kernel panic\nas below because of the leaked notifier callback:\n\nCall trace:\n 0xffffa20fccc04978 (P)\n raw_notifier_call_chain+0x20/0x38\n call_netdevice_notifiers_info+0x60/0xb8\n netdev_lower_state_changed+0x4c/0xb8\n\nAs Sashiko suggested, the teardown order of bonding resources should\nbe inverted to make sure the resources are released when the driver\nis removed."}], "id": "CVE-2026-80625", "lastModified": "2026-08-28T08:16:46.647", "metrics": {}, "published": "2026-08-28T08:16:46.647", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc4caea7a82bbcf94a34eff7094e7f9b501680ab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0bd03b850d81a8914168d87ddf7f6ffa58875ef"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: RDMA/hns: Fix memory leak of bonding resources", "id": "2525472", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525472"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-826", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/hns: Fix memory leak of bonding resources\nIn a corner case of concurrent driver removal and driver reset,\nbonding resource is first released in hns_roce_hw_v2_exit() during\ndriver removal, and then is allocated again in hns_roce_register_device()\nduring driver reset. This leads to memory leak because the release\ntiming has already passed. This may also lead to a kernel panic\nas below because of the leaked notifier callback:\nCall trace:\n0xffffa20fccc04978 (P)\nraw_notifier_call_chain+0x20/0x38\ncall_netdevice_notifiers_info+0x60/0xb8\nnetdev_lower_state_changed+0x4c/0xb8\nAs Sashiko suggested, the teardown order of bonding resources should\nbe inverted to make sure the resources are released when the driver\nis removed.", "A flaw was found in the Linux kernel's RDMA/hns component. During concurrent driver removal and reset operations, bonding resources are incorrectly released and then re-allocated, leading to a memory leak. This memory leak can potentially cause a kernel panic, resulting in a Denial of Service (DoS) for the affected system."], "name": "CVE-2026-80625", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80625\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80625\nhttps://lore.kernel.org/linux-cve-announce/2026082837-CVE-2026-80625-cd6e@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b37ad2e290fc52e575572b04803a4f93f584df6c,bc4caea7a82bbcf94a34eff7094e7f9b501680ab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b37ad2e290fc52e575572b04803a4f93f584df6c,c0bd03b850d81a8914168d87ddf7f6ffa58875ef)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T10:30:17.562368+00:00", "updated": "2026-09-01T17:45:07.120719+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-401", "CWE-459", "CWE-826"]}