Answer in brief
CVE-2026-100075 records a Critical severity (CVSS 9.8) vulnerability in RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 <af00051dbc9f467d4840ec709680660a3f8990fa || >=b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 <717ab4d0614e9446bf8e2de6229464499e4008d6 || >=b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 <f1f2252da52cdda912da9993f39f58783b01b38f || >=b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 <f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d || >=b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 <be1478849e1abb1e12dc12e14cdbf800cc6fa99a || >=b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 <af073bd245180393bcb15d33d3990a6bdc32593a || >=b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 <bd02d644bd19a2795c018635d273d91e45d2bb95 || >=b99f8e4d7bcd3bfbb3cd965918523299370d0cb2 <b38f98e176050850f41bb6415f3a71400056623e | af00051dbc9f467d4840ec709680660a3f8990fa, 717ab4d0614e9446bf8e2de6229464499e4008d6, f1f2252da52cdda912da9993f39f58783b01b38f, f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d, be1478849e1abb1e12dc12e14cdbf800cc6fa99a, af073bd245180393bcb15d33d3990a6bdc32593a, bd02d644bd19a2795c018635d273d91e45d2bb95, b38f98e176050850f41bb6415f3a71400056623e |
| Linux/Linuxgeneric | 4.7 | Not reported |
Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 25, 2026
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.
Quoted source text, attributed separately from HOL analysis.