Strix
74.2K

CVE-2026-93104

UnknownEPSS 0.17%

Last modified

CVE-2026-93104 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvt_alloc_device() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free. Return NULL immediately after deallocation so callers can propagate the allocation failure.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvt_alloc_device() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free. Return NULL immediately after deallocation so callers can propagate the allocation failure.

Metrics

EPSS Probability
0.17%

6.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ff6acd69518e0a84bd9c9b7f1bd4313f7076db97, < 32d2cdb0f3cac430b04124c3b7248851fe2037f8; >= ff6acd69518e0a84bd9c9b7f1bd4313f7076db97, < b7129930d1ec46c03a0de07fdce6c29f75795006; >= ff6acd69518e0a84bd9c9b7f1bd4313f7076db97, < 5a1a7a5e2fe1a15824fa9ae5edd8f008259471d1; >= ff6acd69518e0a84bd9c9b7f1bd4313f7076db97, < 80968b42d13080bf7bc1f3ee17fef126ce2ad98f; >= ff6acd69518e0a84bd9c9b7f1bd4313f7076db97, < b1e1b25723af44328524c7b54433e4bf0ab9930c; >= ff6acd69518e0a84bd9c9b7f1bd4313f7076db97, < 2982eaf3b9d2d953318c74cd6f1b7576ea6d7b1f
LinuxLinux4.6

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-93104?
In the Linux kernel, the following vulnerability has been resolved: RDMA/rvt: Return NULL after port allocation failure rvt_alloc_device() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free. Return NULL immediately after deallocation so callers can propagate the allocation failure.
How severe is CVE-2026-93104?
Severity scoring for CVE-2026-93104 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-93104?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-93104?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST