Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93102— RDMA/hfi1: Free RX data on late probe failure

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： RDMA/hfi1：在迟到的探测失败时释放 RX 数据 在返回之前分配了共享的 AIP/VNIC RX 支持。 如果后续的 或 失败， 会在未调用 的情况下拆除设备数据。这会导致 及其虚拟 netdev 发生内存泄漏。 修复方法：在 IB 注销（unregistration）之后、 之前释放 RX 支持，与正常设备移除时的处理方式保持一致。

AI Predicted 3.2 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1490 · Inhibit System Recovery

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux 4730f4a6c6b2065589c0822af00aa45e639bbc36< cfad037c6d305876b877abc39fd4d7e2185e44f3 affected
4730f4a6c6b2065589c0822af00aa45e639bbc36< d1c91cb02e05fdd93411de707cc5c3c08375df9e affected
4730f4a6c6b2065589c0822af00aa45e639bbc36< 10e5e37495096b58f07adc4020de2701efc3a9e0 affected
4730f4a6c6b2065589c0822af00aa45e639bbc36< cd06c17afb08b37995f66cf560c2332a769b8f80 affected
4730f4a6c6b2065589c0822af00aa45e639bbc36< 149a14ec70887ad14e820a7ca15738ded3d2d493 affected
4730f4a6c6b2065589c0822af00aa45e639bbc36< 83fe4e4f4fbf01d3832a24511c0ddfaccf5df9d8 affected
4730f4a6c6b2065589c0822af00aa45e639bbc36< 8e17e101e04a3dc062e2719da57ff78c1c060632 affected
5.8 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93102

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RDMA/hfi1: Free RX data on late probe failure
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Free RX data on late probe failure hfi1_init_dd() allocates the shared AIP/VNIC RX support before returning. If hfi1_init() or hfi1_register_ib_device() later fails, init_one() tears down the device data without calling hfi1_free_rx(). This leaks netdev_rx and its dummy netdev. Free the RX support after IB unregistration and before postinit_cleanup(), as done on normal device removal.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4730f4a6c6b2065589c0822af00aa45e639bbc36 ~ cfad037c6d305876b877abc39fd4d7e2185e44f3 -
Linux Linux 5.8 -

II. Public POCs for CVE-2026-93102

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93102

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93102 (7)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-93189 8.8 HIGH HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
CVE-2026-90286 8.8 HIGH drm/amdgpu/gfx6: Use PFP on the compute queues too
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90240 8.8 HIGH iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90380 8.8 HIGH wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90425 8.8 HIGH iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-93102

No comments yet

Leave a comment