CVE-2026-100075 Linux CVE debrief

Who should care

Linux kernel administrators, users of RDMA/srpt subsystem, security teams responsible for Linux kernel deployments, and operators managing Linux kernel-based systems should assess exposure and apply available patches or updates. These stakeholders need to verify Linux kernel versions and configurations, and review compensating controls for exposed systems while remediation is scheduled and verified. They should also monitor system logs for potential denial

Why it matters

This vulnerability in the Linux kernel's RDMA/srpt subsystem can cause denial of service or other impacts due to incorrect accounting of send queue credits. Linux kernel administrators and users of the RDMA/srpt subsystem should assess exposure and apply available patches or updates.

• Denial of service due to incorrect send queue credit accounting
• Potential stability issues in RDMA/srpt subsystem
• Need for verification of Linux kernel versions and configurations
• Potential for data corruption or other issues if not properly patched

Technical summary

The vulnerability is caused by incorrect cleanup in the srpt_alloc_rw_ctxs() function, leading to potential incorrect accounting of send queue credits. This can cause issues with the RDMA/srpt subsystem in the Linux kernel, potentially leading to denial of service or other impacts. The issue arises when the srpt_alloc_rw_ctxs() function fails partway through a multi-buffer indirect descriptor, leaving stale values for n_rw_ctx and n_rdma, and a dangling rw_ctxs pointer. Linux kernel administrators and users of the RDMA/srpt subsystem should assess exposure and apply available patches or updates.

Defensive priority

High

Recommended defensive actions

• Review Linux kernel configurations and versions to determine exposure
• Verify RDMA/srpt subsystem usage and assess potential impact
• Apply available patches or updates for the Linux kernel
• Monitor system logs for potential denial of service or other issues
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets
• Review compensating controls for exposed systems while remediation is scheduled

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Linux kernel patch commits are referenced, indicating fixes for the issue. Evidence is limited to public CVE details and supplied source corpus. Defenders should verify Linux kernel versions, configurations, and RDMA/srpt subsystem usage to assess exposure. At least five official references are noted but not detailed here.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.