What’s Vulnerable › Vulnerabilities

CVE-2026-98152: nvmet-rdma: fix queue leak when connect backlog is exceeded

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-25 · updated 2026-10-19
• Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources.

Affected products

• Linux kernel: from 6.12.96 before 6.12.111; from 6.18.39 before 6.18.53; from 7.1.4 before 7.2.7; 7.3-rc1 — fixed in 6.12.111, 6.18.53, 7.2.7

How to fix

Upgrade to a fixed version: Linux kernel 6.12.111, 6.18.53, 7.2.7. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/186414a6a1a34e081b07e8873622f90402346235
• https://git.kernel.org/stable/c/287420cde9d6669abcd2878c344db67423eb7df6
• https://git.kernel.org/stable/c/32e598324edc3ebb1ac9362d5b9fc30ce0de4873
• https://git.kernel.org/stable/c/4f7cf573cdf0ee857448b9b1967d686b07c71e7d
• https://git.kernel.org/stable/c/60d56bf0b14d3c545bacb9aeef92a7e6f2cf0caa
• https://git.kernel.org/stable/c/e48f9d1076f8c62c3969588d638602b94aaeff12
• https://git.kernel.org/stable/c/fb1ed67788e21832b614c23767a088c08cfdd2f2

Get alerted when CVE-2026-98152 or the next vulnerability affects your stack