Linux Kernel EUVD-2026-87055

Requires the in-kernel SCSI RDMA Protocol target (srpt/ib_srpt) to be configured and serving LUNs over an RDMA fabric (InfiniBand or RoCE), with an initiator that has an established SRP session issuing I/O using multi-buffer indirect data descriptors. The bug only manifests when srpt_alloc_rw_ctxs() fails partway through allocation (i.e., under memory pressure / RDMA context exhaustion), which is not directly attacker-controlled; the resulting stale n_rw_ctx/n_rdma and dangling rw_ctxs pointer then corrupt send-queue credit accounting. Limiting factors: needs specialized RDMA hardware and a configured srpt target, an authenticated/established SRP session, and a transient allocation failure - so exploitation is opportunistic and conditional rather than reliable against default configurations.

The input assigns CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but this rating is severely overstated and inconsistent with the described defect. The bug is an error-path unwind flaw in the in-kernel SRP target driver (RDMA/srpt): when srpt_alloc_rw_ctxs() fails partway through building a multi-buffer indirect descriptor, it tears down RDMA contexts but leaves stale n_rw_ctx/n_rdma values and a dangling rw_ctxs pointer, so later sq_wr_avail send-queue-credit accounting in srpt_queue_response()/srpt_write_pending() subtracts the wrong number of credits. That is a state-corruption/DoS condition, not a confidentiality breach - there is no plausible C:H (nothing leaks cross-domain), and the AC:L/PR:N assumptions ignore that the trigger is a partial memory-allocation failure (memory pressure), which is not directly attacker-controlled, and that reaching this path requires an established SRP session with an RDMA target. EPSS, KEV, and public POC are all absent from the input. SSVC-style read: exploitation = none observed, automatable = no (depends on transient alloc failure), technical impact = partial (credit miscount → likely queue stall/crash). Net: this is a high-CVSS-but-low-real-world-risk issue in a niche subsystem. Conflict to flag explicitly: CVSS claims network vector with no privileges and low complexity, but the description implies an authenticated RDMA target session plus an allocation-failure window - verify vector against vendor/subsystem reality before treating as a 9.8.

An initiator connected to a Linux SRP target (srpt) over an RDMA fabric issues I/O using multi-buffer indirect descriptors while the target is under memory pressure, causing srpt_alloc_rw_ctxs() to fail partway and leave stale RDMA context counters. Subsequent responses miscompute send-queue credits, leading to queue accounting corruption and likely a target-side crash or stall (denial of service). No public exploit code is identified at time of analysis, and the trigger depends on a transient allocation failure rather than a deterministic attacker primitive.