CVE-2026-100075: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-100075 is a resource management flaw in the Linux kernel's RDMA/srpt (SCSI RDMA Protocol target) subsystem, specifically in the srpt_alloc_rw_ctxs() function. When this function fails partway through allocating a multi-buffer indirect descriptor, the error unwind path frees RDMA contexts but leaves stale n_rw_ctx and n_rdma counter values along with a dangling rw_ctxs pointer. This corrupts send queue credit accounting in subsequent srpt_queue_response() or srpt_write_pending() calls, potentially leading to denial of service. The vulnerability affects the Linux kernel from version 4.7 onward (introduced at commit b99f8e4d7bcd) across multiple stable branches. It was published on September 25, 2026, with a CVSS v3.1 base score of 9.8 (Critical) as assigned by NVD, though the actual impact is assessed as a denial-of-service condition (GitHub Advisory, Feedly).

The root cause is improper cleanup of internal state variables during error handling in srpt_alloc_rw_ctxs() (CWE-459: Incomplete Cleanup / CWE-672: Operation on a Resource after Expiration or Release). When the function fails mid-way through allocating a multi-buffer indirect descriptor, it destroys already-allocated RDMA contexts but neglects to reset n_rw_ctx, n_rdma, and the rw_ctxs pointer. These stale values are subsequently used by srpt_queue_response() or srpt_write_pending() to calculate available send queue credits, resulting in incorrect accounting. The fix resets the counters and clears the rw_ctxs pointer after freeing the heap allocation before returning an error, applied across multiple stable kernel branches (GitHub Advisory, Kernel Patch).

Successful exploitation causes corrupted send queue credit accounting in the RDMA/srpt subsystem, which can prevent legitimate I/O operations from being queued, effectively crashing or hanging the RDMA target service. The primary impact is availability — an unauthenticated network-based attacker can trigger a denial-of-service condition against systems exposing RDMA/srpt targets. Confidentiality and integrity impacts are not directly demonstrated by the described flaw, despite the NVD CVSS score suggesting otherwise; the realistic impact is limited to service disruption on affected RDMA storage targets (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.422%, indicating a low probability of exploitation in the near term. Exploitation requires the ability to initiate RDMA operations against a vulnerable target, which limits the practical attack surface to environments with exposed RDMA/srpt services.

Apply the upstream kernel patches that reset n_rw_ctx, n_rdma, and clear the rw_ctxs pointer in the error path of srpt_alloc_rw_ctxs(). Fixed versions across stable branches include: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1. The fix is identified by commit af00051dbc9f467d4840ec709680660a3f8990fa and equivalent commits across branches. As a workaround where patching is not immediately possible, restricting network access to RDMA/srpt target ports can reduce exposure (GitHub Advisory, Kernel Patch).

Coverage of CVE-2026-100075 has been limited to automated vulnerability tracking platforms and a brief write-up by The Hacker Wire describing the send queue credit corruption mechanism (The Hacker Wire). No notable researcher commentary or significant community discussion has been observed beyond standard CVE aggregation. Tenable's Nessus scanner (plugin 350753) has added detection for this vulnerability (Tenable).