Linux Kernel CVE-2026-98152

Exploitable ONLY on hosts configured as an NVMe-over-Fabrics RDMA target (the nvmet-rdma driver loaded with an active RDMA listener/port); systems without NVMe-oF RDMA target configured are not affected. The specific trigger is driving pending disconnecting queues past the connect backlog limit, i.e. rapid repeated connect/disconnect churn from one or more initiators. Limiting factors: requires RDMA fabric reachability to the target, the leak is incremental (slow resource exhaustion rather than instant crash), and impact is confined to availability (A:H) with no confidentiality or integrity effect; no user interaction is required.

This is a genuine but low-priority availability issue, not a widespread emergency. The signals are consistent and point to minor risk: CVSS 5.5 (MEDIUM) with A:H but C:N/I:N means pure resource exhaustion with no data or integrity impact; EPSS is very low (0.16%, 5th percentile); the CVE is NOT on CISA KEV; and no public exploit has been identified. The one point worth flagging is the CVSS attack vector: NVD/the kernel CNA assigned AV:L (local), yet the flaw is in the nvmet-rdma connect path, which is exercised by a remote RDMA initiator over the storage fabric - so the realistic trigger is network/adjacent, not a local console user. This AV:L vs. fabric-reachable discrepancy should be verified against deployment topology. Even accounting for that, impact is a slow memory/IB-resource leak (CWE-401) that degrades availability over time rather than granting code execution, so this is a patch-in-normal-maintenance item, heavily gated by the requirement that the host run an NVMe-oF RDMA target at all.

An attacker (or a misbehaving initiator) with reachability to a host acting as an NVMe-over-Fabrics RDMA target repeatedly opens and tears down connections so that pending disconnecting queues exceed the backlog limit. Each rejected connect in this state leaks a freshly allocated queue and its associated InfiniBand resources, and sustained abuse gradually exhausts kernel memory and IB resources, degrading or crashing the storage target. No public exploit code has been identified at time of analysis.