CVE-2026-98152

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98152", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.320Z", "datePublished": "2026-09-25T10:36:24.020Z", "dateUpdated": "2026-10-19T09:14:45.506Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:14:45.506Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: fix queue leak when connect backlog is exceeded\n\nWhen pending disconnecting queues exceed the backlog limit, the\nconnect path only drops the device reference and leaks the newly\nallocated queue and its IB resources."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/target/rdma.c"], "versions": [{"version": "204b9645536bb4a77a2cb35e6519dbf9f4ea1665", "lessThan": "186414a6a1a34e081b07e8873622f90402346235", "status": "affected", "versionType": "git"}, {"version": "00eaa58988d35fd47ca8811f7f72871591f61ffb", "lessThan": "e48f9d1076f8c62c3969588d638602b94aaeff12", "status": "affected", "versionType": "git"}, {"version": "712f3268a62d0df98a7ee991cba963ced2e58007", "lessThan": "32e598324edc3ebb1ac9362d5b9fc30ce0de4873", "status": "affected", "versionType": "git"}, {"version": "d65fe42820b890a6a4644de0a95a812471f79ad3", "lessThan": "287420cde9d6669abcd2878c344db67423eb7df6", "status": "affected", "versionType": "git"}, {"version": "a8803c4f0ac3fa7df5551bbb5a8800c434a94357", "lessThan": "4f7cf573cdf0ee857448b9b1967d686b07c71e7d", "status": "affected", "versionType": "git"}, {"version": "badc53620fe813b3a9f727ef9526f98567c2c898", "lessThan": "60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa", "status": "affected", "versionType": "git"}, {"version": "badc53620fe813b3a9f727ef9526f98567c2c898", "lessThan": "fb1ed67788e21832b614c23767a088c08cfdd2f2", "status": "affected", "versionType": "git"}, {"version": "5828517d17eda27f21d29ea14800c9e0a57bad11", "status": "affected", "versionType": "git"}, {"version": "6.12.96", "lessThan": "6.12.111", "status": "affected", "versionType": "semver"}, {"version": "6.18.39", "lessThan": "6.18.53", "status": "affected", "versionType": "semver"}, {"version": "7.1.4", "lessThan": "7.2", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/target/rdma.c"], "versions": [{"version": "7.2", "status": "affected"}, {"version": "0", "lessThan": "7.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.96", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.39", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.2", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1.4"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/186414a6a1a34e081b07e8873622f90402346235"}, {"url": "https://git.kernel.org/stable/c/e48f9d1076f8c62c3969588d638602b94aaeff12"}, {"url": "https://git.kernel.org/stable/c/32e598324edc3ebb1ac9362d5b9fc30ce0de4873"}, {"url": "https://git.kernel.org/stable/c/287420cde9d6669abcd2878c344db67423eb7df6"}, {"url": "https://git.kernel.org/stable/c/4f7cf573cdf0ee857448b9b1967d686b07c71e7d"}, {"url": "https://git.kernel.org/stable/c/60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa"}, {"url": "https://git.kernel.org/stable/c/fb1ed67788e21832b614c23767a088c08cfdd2f2"}], "title": "nvmet-rdma: fix queue leak when connect backlog is exceeded", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/target/rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "186414a6a1a34e081b07e8873622f90402346235", "status": "affected", "version": "204b9645536bb4a77a2cb35e6519dbf9f4ea1665", "versionType": "git"}, {"lessThan": "e48f9d1076f8c62c3969588d638602b94aaeff12", "status": "affected", "version": "00eaa58988d35fd47ca8811f7f72871591f61ffb", "versionType": "git"}, {"lessThan": "32e598324edc3ebb1ac9362d5b9fc30ce0de4873", "status": "affected", "version": "712f3268a62d0df98a7ee991cba963ced2e58007", "versionType": "git"}, {"lessThan": "287420cde9d6669abcd2878c344db67423eb7df6", "status": "affected", "version": "d65fe42820b890a6a4644de0a95a812471f79ad3", "versionType": "git"}, {"lessThan": "4f7cf573cdf0ee857448b9b1967d686b07c71e7d", "status": "affected", "version": "a8803c4f0ac3fa7df5551bbb5a8800c434a94357", "versionType": "git"}, {"lessThan": "60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa", "status": "affected", "version": "badc53620fe813b3a9f727ef9526f98567c2c898", "versionType": "git"}, {"lessThan": "fb1ed67788e21832b614c23767a088c08cfdd2f2", "status": "affected", "version": "badc53620fe813b3a9f727ef9526f98567c2c898", "versionType": "git"}, {"status": "affected", "version": "5828517d17eda27f21d29ea14800c9e0a57bad11", "versionType": "git"}, {"lessThan": "6.12.111", "status": "affected", "version": "6.12.96", "versionType": "semver"}, {"lessThan": "6.18.53", "status": "affected", "version": "6.18.39", "versionType": "semver"}, {"lessThan": "7.2", "status": "affected", "version": "7.1.4", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/target/rdma.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.2"}, {"lessThan": "7.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2623A50-55BD-4589-AD5C-711B7215C3B6", "versionEndExcluding": "6.12.111", "versionStartIncluding": "6.12.96", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7705E07-FFAE-48C3-BE81-14DDEC478D18", "versionEndExcluding": "6.18.53", "versionStartIncluding": "6.18.39", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "884C2A3B-3C29-41BB-ADFE-525F21B330B2", "versionEndExcluding": "7.2.7", "versionStartIncluding": "7.1.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.3:rc1:*:*:*:*:*:*", "matchCriteriaId": "11E35E1B-5DB4-4AB9-9706-CD73B799EADF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: fix queue leak when connect backlog is exceeded\n\nWhen pending disconnecting queues exceed the backlog limit, the\nconnect path only drops the device reference and leaks the newly\nallocated queue and its IB resources."}], "id": "CVE-2026-98152", "lastModified": "2026-10-19T10:18:14.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-09-25T11:17:46.820", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/186414a6a1a34e081b07e8873622f90402346235"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/287420cde9d6669abcd2878c344db67423eb7df6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32e598324edc3ebb1ac9362d5b9fc30ce0de4873"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4f7cf573cdf0ee857448b9b1967d686b07c71e7d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e48f9d1076f8c62c3969588d638602b94aaeff12"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fb1ed67788e21832b614c23767a088c08cfdd2f2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nvmet-rdma: fix queue leak when connect backlog is exceeded", "id": "2541372", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541372"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnvmet-rdma: fix queue leak when connect backlog is exceeded\nWhen pending disconnecting queues exceed the backlog limit, the\nconnect path only drops the device reference and leaks the newly\nallocated queue and its IB resources.", "A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over Fabrics RDMA (Remote Direct Memory Access) target subsystem. When pending disconnecting queues exceed the backlog threshold, the connection handler fails to release newly allocated queue structures and associated network resources. A remote attacker could exploit this issue by initiating connection requests during backlog conditions, leading to resource leaks and a potential Denial of Service (DoS) through memory exhaustion."], "name": "CVE-2026-98152", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98152\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98152\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98152.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[204b9645536bb4a77a2cb35e6519dbf9f4ea1665,186414a6a34e081b07e8873622f90402346235)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[00eaa58988d35fd47ca8811f7f72871591f61ffb,e48f9d1076f8c62c3969588d638602b94aaeff12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[712f3268a62d0df98a7ee991cba963ced2e58007,32e598324edc3ebb1ac9362d5b9fc30ce0de4873)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d65fe42820b890a6a4644de0a95a812471f79ad3,287420cde9d6669abcd2878c344db67423eb7df6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a8803c4f0ac3fa7df5551bbb5a8800c434a94357,4f7cf573cdf0ee857448b9b1967d686b07c71e7d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[badc53620fe813b3a9f727ef9526f98567c2c898,60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[badc53620fe813b3a9f727ef9526f98567c2c898,fb1ed67788e21832b614c23767a088c08cfdd2f2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5828517d17eda27f21d29ea14800c9e0a57bad11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.96,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.39,6.18.53)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T12:15:16.539797+00:00", "updated": "2026-10-02T17:15:08.344294+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}