CVE-2026-90415

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.

Is your site exposed to CVE-2026-90415?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.07%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712 https://git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96 https://git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99 https://git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e https://git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7 https://git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57 https://git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486 https://git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd

Frequently Asked Questions

What is CVE-2026-90415? +

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.

How do I check if I'm vulnerable to CVE-2026-90415? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.