CVE-2026-97477 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who rely on RDMA/counter functionality should assess exposure and verify port state and num_counters values. They should review Linux kernel configurations and versions for exposure and monitor for MANUAL mode leaks and AUTO mode transitions. The vulnerability can cause a num_counters leak, preventing port state transitions and auto-reverts.

Why it matters

A vulnerability in the Linux kernel's RDMA/counter subsystem can cause a num_counters leak, preventing port state transitions and auto-reverts. Linux kernel developers, administrators, and users should assess exposure and verify port state and num_counters values.

• Verification of port state and num_counters values is required to assess exposure
• Potential denial of service due to port state inconsistencies
• Required review of Linux kernel configurations and versions for exposure

Technical summary

The Linux kernel's RDMA/counter subsystem has a vulnerability that can cause a num_counters leak when bind_qp fails in alloc_and_bind(). This can prevent the port from switching to AUTO mode and block the MANUAL→NONE auto-revert in rdma_counter_free(). The vulnerability has been resolved with a patch. Linux kernel developers, administrators, and users who rely on RDMA/counter functionality should assess exposure and verify port state and num_counters values. The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and versions is not explicitly stated.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel configurations and versions for exposure
• Verify port state and num_counters values
• Monitor for MANUAL mode leaks and AUTO mode transitions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and versions is not explicitly stated. The Linux kernel patch references are provided, but no additional information on exploitation or impact is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.