VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98354: Linux kernel · RDMA/mad: Fix receive buffer leak when PKey enforcement fails

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in c0d8df85db146d6275e226cb950023be69dd6c77 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 16:39 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in c0d8df85db146d6275e226cb950023be69dd6c77, bad289e42f512646a988f278f536d21547df73f1, 5091e25ec503f7fc02723ca435226467b68caac7 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < c0d8df85db146d6275e226cb950023be69dd6c77	Fixed in c0d8df85db146d6275e226cb950023be69dd6c77
LinuxLinux	Affected ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < bad289e42f512646a988f278f536d21547df73f1	Fixed in bad289e42f512646a988f278f536d21547df73f1
LinuxLinux	Affected ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < 5091e25ec503f7fc02723ca435226467b68caac7	Fixed in 5091e25ec503f7fc02723ca435226467b68caac7
LinuxLinux	Affected ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < 4617c9a856188674dddb0ca66979746d07688579	Fixed in 4617c9a856188674dddb0ca66979746d07688579
LinuxLinux	Affected ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < 3476c28c9addfa253f505e6bd87f1f5598b961d0	Fixed in 3476c28c9addfa253f505e6bd87f1f5598b961d0
LinuxLinux	Affected ≥ 47a2b338fe63200d716d2e24131cdb49f17c77da, < 752b30e9d339008e5ce7eed412e9446078916129	Fixed in 752b30e9d339008e5ce7eed412e9446078916129

AI-suggested

A fix is available in the Linux kernel as indicated by the presence of fixed commit versions. Users should update to a patched kernel version containing these fixes. No additional mitigation is required beyond applying the official patch.

Description

A vulnerability in the Linux kernel's RDMA/mad subsystem causes a receive buffer leak when PKey enforcement fails. The flaw occurs because the receive buffer is not properly linked to a list before a security check, leading to a failure to free the buffer on error. This results in a memory leak of approximately 300 bytes per InfiniBand port MAD or about 2 KB for OPA. An attacker can exploit this by repeatedly sending MADs with incorrect PKeys, causing resource exhaustion.

Impact

This vulnerability causes a memory leak in the kernel's RDMA/mad subsystem when PKey enforcement fails. The leak consumes kernel memory (about 300 bytes per InfiniBand port MAD or ~2 KB for OPA) for each failed MAD received. A remote attacker can exploit this by sending multiple MADs with incorrect PKeys, potentially leading to resource exhaustion and degraded system performance or denial of service.

Summary

The Linux kernel's RDMA/mad component improperly handles receive buffers when PKey enforcement fails. Specifically, ib_mad_complete_recv() initializes a list but does not link the receive buffer to it before calling ib_mad_enforce_security(). If the security check fails, the cleanup function ib_free_recv_mad() attempts to free buffers by walking the list, but since the list is empty, no buffers are freed, causing a memory leak. The caller also cannot free the buffer because it assumes ownership has been transferred. This leak can be triggered remotely by sending MADs with invalid PKeys. The fix involves linking the receive buffer to the list immediately after initialization to ensure proper cleanup on failure.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:35 UTC

Technical details

References

Community reviews

Related threats