CVE-2026-93151 Linux CVE debrief

Who should care

Linux kernel administrators and security teams should assess exposure and verify patch deployment to prevent potential resource exhaustion and denial-of-service (DoS) attacks. This includes reviewing system resources and logs for signs of potential resource exhaustion or DoS attacks, and verifying the fix using blktests nvme/061 with the rdma transport and the siw driver. Additionally, defenders should prioritize patching or mitigating this vulnerability.

Why it matters

Defenders should prioritize patching or mitigating this vulnerability to prevent potential resource exhaustion and denial-of-service (DoS) attacks. Linux kernel administrators and security teams should assess exposure and verify patch deployment.

• Resource exhaustion and potential denial-of-service (DoS) attacks.
• Memory leaks can lead to system resource depletion.
• Verification of patch deployment is necessary to prevent exploitation.

Technical summary

The vulnerability exists in the nvmet-rdma component of the Linux kernel. When an NVMe target with rdma transport is removed while I/Os are in flight, responses can be posted but their send completions are never delivered, leading to resource leaks. The issue can be recreated using blktests nvme/061 with the rdma transport and the siw driver. This can lead to memory leaks and potential denial-of-service (DoS) attacks. Linux kernel administrators and security teams should assess exposure and verify patch deployment to prevent potential resource exhaustion and denial-of-service (DoS) attacks.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability to prevent potential resource exhaustion and denial-of-service (DoS) attacks. Linux kernel administrators and security teams should assess exposure and verify patch deployment.

Recommended defensive actions

• Patch or update the Linux kernel to the latest version that includes the fix for this vulnerability.
• Run blktests nvme/061 with the rdma transport and the siw driver to verify the fix.
• Monitor system resources and logs for signs of potential resource exhaustion or DoS attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by a response resource leak on queue teardown in the nvmet-rdma component of the Linux kernel. This leak occurs when an NVMe target with rdma transport is removed while I/Os are in flight. The issue can be recreated using blktests nvme/061 with the rdma transport and the siw driver. Kernel kmemleak feature reports the memory leaks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.