The Linux kernel RDMA core had a vulnerability (CVE-2026-74299) in the FRMR aging push to queue error flow. Aging pools with pinned handles require moving handles from an active queue to a non-empty inactive queue, which might fail due to new page allocation. The original code did not handle allocation failures properly, resulting in leaking memory keys (mkeys). The fix introduces push_queue_to_queue_locked(), which moves pages from the source queue to the destination queue without performing new allocations, thus eliminating the failure scenario. This helper replaces previous per-handle move loops and splices, removing GFP_ATOMIC allocations under the pool lock and simplifying error flow.

The vulnerability could cause memory key leaks in the RDMA core of the Linux kernel due to improper error handling during queue page moves under memory pressure. This could potentially lead to resource exhaustion or instability in systems using RDMA. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue by introducing a new helper function that prevents allocation failures during queue page moves. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed here; check the vendor advisory or Linux kernel release notes for the specific fixed versions and update accordingly.