CVE-2026-100075: Linux RDMA SRPT Flaw

Are You Affected?

CVE-2026-100075 is a Linux kernel vulnerability affecting systems that use the kernel’s RDMA SCSI RDMA Protocol target driver, commonly referred to as SRPT. The defect is in an error-unwind path in srpt_alloc_rw_ctxs(), where a partially failed allocation can leave stale RDMA-context accounting and a dangling pointer.

Systems that do not load or use the SRPT target functionality are not exposed to this specific code path.

The NVD record identifies the product generically as the Linux kernel and does not provide a precise version range. Five Linux stable commit references are associated with the correction:

• 717ab4d0614e9446bf8e2de6229464499e4008d6
• af00051dbc9f467d4840ec709680660a3f8990fa
• af073bd245180393bcb15d33d3990a6bdc32593a
• b38f98e176050850f41bb6415f3a71400056623e
• bd02d644bd19a2795c018635d273d91e45d2bb95

Their exact stable-release mapping was not available in the retrieved material.

Prioritize hosts where the RDMA subsystem is enabled, the SRPT target driver is loaded, and SRPT services accept connections from untrusted or semi-trusted initiators. For distribution kernels, the vendor advisory is authoritative because distributions frequently backport fixes without changing the upstream kernel version in an obvious way.

For broader prioritization, organizations can document the affected assets and business impact using a formal risk management framework.

Analyst’s Take: Start with exposure, not the headline score: confirm whether SRPT is loaded and whether the host serves SRPT connections. The missing CVSS vector and exact fixed version make the vendor advisory and package-level verification more useful than assumptions based on a generic kernel version.

The Fix, If You’re in a Hurry

The upstream correction resets n_rw_ctx and n_rdma, then clears rw_ctxs after freeing the allocated memory and before returning the allocation error. This prevents later response or pending-write paths from using stale context counts or a freed pointer during send-queue credit calculations.

There is no responsibly quotable fixed kernel version in the retrieved NVD response. Administrators should not assume that a particular major or minor kernel release is fixed solely from the CVE number. Instead, identify the installed distribution package, review its security advisory, and confirm that the vendor has backported the SRPT correction.

Technical Notes

First identify the running kernel and whether SRPT is loaded:

uname -a
lsmod | grep -E '(^|_)srpt($|_)|(^|_)ib_srpt($|_)'
modinfo srpt 2>/dev/null || modinfo ib_srpt 2>/dev/null

Use the package manager appropriate to the operating system after confirming the vendor’s patched package name. These are operational examples, not a substitute for the distribution advisory:

# Debian or Ubuntu systems using the distribution kernel package
sudo apt update
sudo apt install --only-upgrade linux-image-generic linux-headers-generic

# Fedora, RHEL, Rocky, or Alma systems
sudo dnf upgrade kernel

Reboot into the updated kernel when required, then verify the running release and package changelog. If SRPT is not required, a temporary mitigation is to stop the dependent service, unload the module if possible, and prevent it from loading at boot:

sudo systemctl stop <service-that-uses-srpt>
sudo modprobe -r srpt 2>/dev/null || sudo modprobe -r ib_srpt
printf 'blacklist srpt\nblacklist ib_srpt\n' | sudo tee /etc/modprobe.d/disable-srpt.conf
sudo depmod -a

Do not apply that workaround on an active SRPT target without understanding the resulting storage impact. Disabling SRPT can interrupt dependent workloads; patching remains the preferred remediation.

How This Vulnerability Works

The affected function allocates and initializes RDMA read/write contexts while processing a multi-buffer indirect descriptor. Allocation may fail after some contexts have already been created. The function then enters an unwind path intended to destroy the resources allocated before the failure.

The defect is that cleanup destroys the already-created RDMA contexts but does not fully reset the state associated with them. Specifically, n_rw_ctx and n_rdma retain stale values, while rw_ctxs can continue to reference memory that has already been freed. The function returns an error, but later code can still observe that inconsistent state.

The stale state matters because subsequent processing uses the context information in send-queue availability calculations. The relevant paths include srpt_queue_response() and srpt_write_pending(). Those paths can subtract an incorrect number of send-queue credits, creating a queue-accounting failure.

The supplied research does not establish a reliable end impact beyond the incorrect accounting and associated kernel risk, so defenders should avoid assuming a specific outcome such as remote code execution.

The correction makes failure cleanup idempotent from the caller’s perspective: after freeing the allocation and destroying created contexts, it resets the counters and clears the pointer before returning. Callers will not later use the partially initialized object as though allocation had succeeded.

Severity, Explained

NVD assigns CVE-2026-100075 a CVSS score of 9.8. That is a critical numerical rating and warrants prompt triage on systems using SRPT. However, the retrieved NVD response did not include the CVSS vector, so the individual components cannot be stated reliably.

The available data does not establish whether the score assumes network or local access, whether authentication is required, or which confidentiality, integrity, and availability impacts were selected. The attack vector and authentication fields in the quick-reference table are therefore marked unknown rather than inferred from the presence of RDMA or SRPT.

Organizations should use the 9.8 score for prioritization while relying on the vendor advisory and local exposure review for operational risk decisions.

The practical exposure is narrower than “every Linux host”: the affected driver and functionality must be relevant to the workload. A host that runs a Linux kernel but neither loads nor uses the SRPT target functionality should be treated differently from an RDMA storage target reachable by multiple initiators.

Is It Being Exploited?

CVE-2026-100075 is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The supplied record reports on_kev: false, with no CISA date-added, remediation due date, required-action entry, or ransomware-campaign designation.

No confirmed exploitation in the wild was identified in the retrieved NVD or CISA data. No public exploit or proof-of-concept repository was identified in the searches performed.

These are status statements about the available evidence, not guarantees that exploitation is impossible or that future reports will not emerge.

The absence of a KEV listing should not delay remediation for exposed SRPT infrastructure. Kernel vulnerabilities can be difficult to attribute from general system failures, and the defect involves an error path that may be triggered only under particular allocation and descriptor conditions. Treat the issue as unconfirmed exploited, not as harmless.