{"id":25627,"date":"2026-09-18T04:31:39","date_gmt":"2026-09-17T20:31:39","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90218"},"modified":"2026-09-18T04:31:39","modified_gmt":"2026-09-17T20:31:39","slug":"cve-2026-90218","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90218","title":{"rendered":"CVE-2026-90218 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA\/cma: Fix WARNING"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>RDMA\/cma: Fix WARNING in res_to_rt<\/p>\n<p>syzbot reported a WARN_ON(!res-&gt;dev) in res_to_rt() triggered via<br \/>\naddr_handler() during asynchronous address resolution:<\/p>\n<p>&#8221;<br \/>\nWARNING: drivers\/infiniband\/core\/restrack.c:138 at res_to_rt+0x1c4\/0x230<br \/>\nCPU#1: kworker\/u8:4\/59<br \/>\nModules linked in:<br \/>\nCPU: 1 UID: 0 PID: 59 Comm: kworker\/u8:4 Not tainted syzkaller #0 PREEMPT(full)<br \/>\nHardware name: Google Compute Engine, BIOS Google 07\/24\/2026<br \/>\nWorkqueue: ib_addr process_one_req<br \/>\nRIP: 0010:res_to_rt+0x1c4\/0x230 drivers\/infiniband\/core\/restrack.c:138<br \/>\nRSP: 0018:ffffc9000201f850 EFLAGS: 00010293<br \/>\nRAX: ffffffff88d00ce5 RBX: ffff88807f0fd4f8 RCX: ffff88801e6e0000<br \/>\nRDX: 0000000000000000 RSI: ffffffff8fd996f0 RDI: 0000000000000003<br \/>\nRBP: 0000000000000000 R08: ffff88801e6e0000 R09: 000000000000000a<br \/>\nR10: 0000000000000009 R11: 0000000000000000 R12: dffffc0000000000<br \/>\nR13: 1ffff1100fe1fa9f R14: 0000000000000000 R15: 0000000000000003<br \/>\nFS:  0000000000000000(0000) GS:ffff888125012000(0000) knlGS:0000000000000000<br \/>\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033<br \/>\nCR2: 00001d559c3d2000 CR3: 0000000077c4c000 CR4: 00000000003526f0<br \/>\nCall Trace:<\/p>\n<p> rdma_restrack_add+0x5a\/0x8a0 drivers\/infiniband\/core\/restrack.c:236<br \/>\n addr_handler+0x41a\/0x5a0 drivers\/infiniband\/core\/cma.c:3534<br \/>\n process_one_req+0x2eb\/0x540 drivers\/infiniband\/core\/addr.c:624<br \/>\n process_one_work kernel\/workqueue.c:3375 [inline]<br \/>\n process_scheduled_works+0xc4e\/0x1630 kernel\/workqueue.c:3458<br \/>\n worker_thread+0xa47\/0xfb0 kernel\/workqueue.c:3539<br \/>\n kthread+0x388\/0x470 kernel\/kthread.c:436<br \/>\n ret_from_fork+0x514\/0xb70 arch\/x86\/kernel\/process.c:158<br \/>\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245<\/p>\n<p>&#8221;<\/p>\n<p>In addr_handler(), cma_acquire_dev_by_src_ip() is called to populate<br \/>\nid_priv-&gt;cma_dev and bind the associated ib_device to id_priv-&gt;id.device.<br \/>\nIf cma_acquire_dev_by_src_ip() returns an error (non-zero status), the ID<br \/>\nremains unassociated with any RDMA device.<\/p>\n<p>Previously, rdma_restrack_add(&amp;id_priv-&gt;res) was invoked unconditionally<br \/>\neven when cma_acquire_dev_by_src_ip() failed, passing a resource with a<br \/>\nNULL dev pointer and triggering the WARN_ON assertion in res_to_rt().<\/p>\n<p>Fix this by only adding the resource to restrack when acquiring the device<br \/>\nsucceeds.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>RDMA\/cma: Fix WARNING in res_to_rt<\/p>\n<p>syzbot reported a WARN_ON(!res-&gt;dev) in res_to_rt() triggered via<br \/>\naddr_handler() during asynchr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25627","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}