CVE-2026-98154

high

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a h…

Vendor / product: Linux — linux kernel

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.

CVSS

7.0

7.0 (CVSS v3.1)

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity source: NVD CVSS v3.1 (416baaa9-dc9f-4396-8d5f-8c081fb06d67)

Timeline (UTC)

Published: 2026-09-25 11:17

Modified: 2026-10-20 17:00

NVD status: Analyzed

Last synced 2 days ago

Verified against the source API 2026-10-27 06:55 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

linux / linux_kernel ≥5.12 <5.15.222, ≥6.1 <6.1.189, ≥6.6 <6.6.158, ≥6.12 <6.12.111, ≥6.13 <6.18.53, ≥7.2 <7.2.7

Weakness classification (CWE)

CWE-415

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Patch / mitigation: https://git.kernel.org/stable/c/171b993a4aed9889159df4815b6a6ba141e61975

Patch / mitigation: https://git.kernel.org/stable/c/965804b20c0f02c1a6cf4b69c0498a79e56f97fe

Patch / mitigation: https://git.kernel.org/stable/c/a41e7fc8d244d9cfc6273051aed85b67adedbb89

Patch / mitigation: https://git.kernel.org/stable/c/c2459519b39587c9c27d6b8a8cf516fee10fce66

Patch / mitigation: https://git.kernel.org/stable/c/ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bb

Patch / mitigation: https://git.kernel.org/stable/c/cf3e706963ffbd3ee2568fa0d08ab016f0575ea8

Patch / mitigation: https://git.kernel.org/stable/c/d61828199c6cb4b76d48403c77023cd4bb9d09fc

References

https://git.kernel.org/stable/c/171b993a4aed9889159df4815b6a6ba141e61975 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/965804b20c0f02c1a6cf4b69c0498a79e56f97fe 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a41e7fc8d244d9cfc6273051aed85b67adedbb89 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c2459519b39587c9c27d6b8a8cf516fee10fce66 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bb 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cf3e706963ffbd3ee2568fa0d08ab016f0575ea8 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d61828199c6cb4b76d48403c77023cd4bb9d09fc 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-98154

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs