Linux Kernel CVE-2026-93151

Requires the target host to run the Linux NVMe-oF target stack with the RDMA transport (nvmet-rdma) actively serving connections over an RDMA-capable fabric (hardware RDMA NIC or the siw software-iWARP driver, as used in the blktests nvme/061 reproducer). The leak is triggered specifically when a queue/QP is torn down - e.g., the target is removed or the RDMA connection is disrupted - while NVMe I/O responses are still in flight, so their send completions are never delivered. Limiting factors: the subsystem must be configured and in use (default installs do not run an NVMe-oF RDMA target), each event leaks only small allocations so impact requires many repeated teardown cycles to exhaust memory, and no confidentiality/integrity impact exists (availability only). No user interaction is required.

This is a kernel memory leak in the NVMe-oF RDMA target (nvmet-rdma), not a memory-corruption or disclosure bug. The vendor CVSS is 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - the C:N/I:N confirms there is no confidentiality or integrity impact, so the 'Information Disclosure' tag is contradicted by the vendor's own vector and is mislabeled; the only impact is availability (A:H) via gradual memory exhaustion. The AV:N/AC:L/PR:N portion appears overstated: the leak is triggered on queue/QP teardown when an RDMA target is removed while I/Os are in flight (the description and kmemleak backtrace show it reproduced via blktests nvme/061 over the siw software RDMA driver), which is an administrative/teardown event rather than a clean remote-unauthenticated code path an outside attacker directly drives, and a single occurrence leaks only small SGL/rw-context allocations (32-64 bytes) so exhaustion requires many repeated teardown cycles. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data - exploitation status is 'no public exploit identified at time of analysis'. Net: a real but low-urgency reliability/DoS bug in a niche subsystem; the headline 7.5 overstates practical risk. Conflicting signal to verify: CVSS asserts network vector with no privileges, but the described trigger (target removal / connection teardown during in-flight I/O) implies local/administrative involvement - verify the true attacker-reachability with the maintainer.

An operator or fault removes/tears down an nvmet-rdma target (or an RDMA connection drops) while NVMe-oF clients have I/Os in flight; responses whose send completions never fire skip nvmet_rdma_send_done()/release_rsp(), permanently leaking their RDMA read/write contexts and request SGLs. Repeated connect/teardown cycles under load slowly exhaust kernel memory, degrading or crashing the storage target host. No public exploit code is identified, and the effect is a gradual resource leak rather than instantaneous compromise.