Linux Kernel EUVD-2026-86985

Requires the nvme-rdma host driver to be loaded and the host actively connected to an NVMe-oF target over an RDMA fabric (RoCE/iWARP/InfiniBand). The faulty path only executes when nvme_rdma_queue_rq returns -EIO - a transient RDMA/fabric command-submission failure that is not directly attacker-controllable. Exploitation is limited by: this being an error path (AC:H), the local-only vector (AV:L), the need for privileges to interact with the NVMe I/O path (PR:L), and the niche NVMe-oF/RDMA deployment requirement. It cannot be triggered against a default host that has no NVMe-oF/RDMA connectivity.

This is a classic high-CVSS-but-low-real-risk kernel error-path bug, consistent with the entire recent NVD 7.0 batch of Linux nvme/storage fixes. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) already concedes local access, high complexity, and required privileges, yet still inflates all three impact metrics to High. In reality this is a cleanup-ordering defect: on an -EIO in nvme_rdma_queue_rq, the host-path-error helper completes and frees the request, and the code THEN runs the outer command cleanup and unmaps the SQE DMA again - a double cleanup / double DMA-unmap AFTER the request is already complete. That is a memory-corruption / use-after-complete condition whose realistic outcome is a crash or corruption (DoS), not information disclosure. The 'Information Disclosure' tag is therefore mislabeled; confidentiality impact is not credible (C:N), and integrity impact is at most incidental corruption (I:L). No EPSS score, no CISA KEV listing, and no public exploit are present. Critically, the -EIO trigger is a transient RDMA/fabric submission failure, not an attacker-controlled input, so even a local privileged user cannot reliably drive this path on demand - confirming AC:H and low real-world priority. Net: patch on normal stable-kernel cadence; not an emergency.

On a host running the nvme-rdma driver and connected to an NVMe-oF target over RDMA, a transient fabric/RDMA submission error causes queue_rq to return -EIO; the host-path-error helper completes and frees the request while the outer cleanup path then unmaps the SQE DMA and cleans the already-freed command, corrupting kernel memory and typically crashing the node. No public exploit exists, and because the -EIO path is not attacker-controlled, reliable triggering is impractical.