nvmet-rdma: fix response resource leak on queue teardown

{
  "id": "b73369f16ca0280a43694078684c6708a28765a0f94d8a70c7b9cea7cb7049d5",
  "url": "https://osv.dev/vulnerability/CVE-2026-93151",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "nvmet-rdma: fix response resource leak on queue teardown",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix response resource leak on queue teardown When an nvme target with rdma transport is removed while I/Os are in flight, a response can be posted but its send completion is never delivered before the connection is torn down. As a result nvmet_rdma_send_done() and nvmet_rdma_release_rsp() are never called for the response, and this leaks the allocated RDMA read/write context and request SGLs. These leaks are recreated by running blktests nvme/061 with the rdma transport and the siw driver. Kernel kmemleak feature reports them as follows: unreferenced object 0xffff88812bc490c0 (size 32): comm \"kworker/2:1H\", pid 409, jiffies 4307744490 backtrace (crc 89afd339): __kmalloc_noprof+0x5f9/0x890 sgl_alloc_order+0x7b/0x380 nvmet_req_alloc_sgls+0x290/0x4f0 [nvmet] nvmet_rdma_map_sgl_keyed+0x241/0x12e0 [nvmet_rdma] nvmet_rdma_handle_command+0x73e/0xb80 [nvmet_rdma] __ib_process_cq+0x149/0x4c0 [ib_core] ib_cq_poll_work+0x49/0x160 [ib_core] process_one_work+0x8b2/0x1640 worker_thread+0x5fd/0xfe0 kthread+0x367/0x460 ret_from_fork+0x655/0x9d0 ret_from_fork_asm+0x1a/0x30 unreferenced object 0xffff88814bd05e80 (size 64): comm \"kworker/3:1H\", pid 148, jiffies 4295195428 backtrace (crc e35510cb): __kmalloc_noprof+0x5f9/0x890 rdma_rw_ctx_init+0x333/0x1fa0 [ib_core] nvmet_rdma_map_sgl_keyed+0x5c8/0x12e0 [nvmet_rdma] nvmet_rdma_handle_command+0x73e/0xb80 [nvmet_rdma] __ib_process_cq+0x149/0x4c0 [ib_core] ib_cq_poll_wo",
    "evidence": "osv:CVE-2026-93151",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.15.221",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.188",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.157",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.110",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.52",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-93151",
      "aliases": [
        "CVE-2026-93151"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8f000cac6e7a6edca7ab93bafc7ed28b27c1545b"
                },
                {
                  "fixed": "91cfa74f1f3772e8c3662c064a45d8633e00c78e"
                },
                {
                  "fixed": "156ec10a8be2c33b0c279d8b2f4fe8e16fa89ef7"
                },
                {
                  "fixed": "9584b3c30e4ee8ca315bdc12249cc6c47cf1a482"
                },
                {
                  "fixed": "5cc3b21729d45b5af8f79891f9dedb7e6b6dbd08"
                },
                {
                  "fixed": "ca795fc1d8a1a4ab0e6bd1d27c9adb78d4ed1a1c"
                },
                {
                  "fixed": "d553a9dc1c45666e76d8d2ac9a4f8ff0cbf53a50"
                },
                {
                  "fixed": "0114dd303b373522dea06053aabae34bdd33a7c4"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93151.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.8.0"
                },
                {
                  "fixed": "5.15.221"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.188"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.157"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.110"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.52"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93151.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:50.769234218Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/0114dd303b373522dea06053aabae34bdd33a7c4",
        "https://git.kernel.org/stable/c/156ec10a8be2c33b0c279d8b2f4fe8e16fa89ef7",
        "https://git.kernel.org/stable/c/5cc3b21729d45b5af8f79891f9dedb7e6b6dbd08",
        "https://git.kernel.org/stable/c/91cfa74f1f3772e8c3662c064a45d8633e00c78e",
        "https://git.kernel.org/stable/c/9584b3c30e4ee8ca315bdc12249cc6c47cf1a482",
        "https://git.kernel.org/stable/c/ca795fc1d8a1a4ab0e6bd1d27c9adb78d4ed1a1c",
        "https://git.kernel.org/stable/c/d553a9dc1c45666e76d8d2ac9a4f8ff0cbf53a50",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93151.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-93151",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93151.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-93151",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 519483,
  "published_at": "2026-09-17T16:11:47.559+00:00"
}