CVE-2026-93107

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the RDMA/rxe component where the responder state machine may reprocess a packet after the Queue Pair (QP) enters an error state. This occurs when do complete() returns RESPST CHK RESOURCE while a packet is being completed, causing the system to loop back into the request processing chain. Consequently, the same packet payload is copied multiple times via execute() or send data in(), and multiple IB WC SUCCESS completions are posted for a single send operation. This behavior can lead to data stream corruption for Upper Layer Protocols (ULP) that rely on exactly-once delivery. Furthermore, once the Receive Queue (RQ) is exhausted, the send data in() function attempts to dereference a NULL pointer (qp->resp.wqe), resulting in a kernel NULL pointer dereference and system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.