CVE-2025-71084

RDMA/cm: Fix leaking the multicast GID table reference

State: Published
Severity: Not scored
Published: Jan 13, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cm: Fix leaking the multicast GID table reference

If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr. This leaks a refcount and triggers a WARN:

GID entry ref leak for dev syz1 index 2 ref=573 WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline] WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886

Destroy the ah_attr after canceling the work, it is safe to call this twice.

Scores

The record has no CVSS score.

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	60d613b39e8d0c9f3b526e9c96445422b4562d76 to before d5ce588a9552878859a4d44b70b724216c188a5fAffected fe454dc31e84f8c14cb8942fcb61666c9f40745b to before abf38398724ecc888f62c678d288da40d11878afAffected fe454dc31e84f8c14cb8942fcb61666c9f40745b to before ab668a58c4a2ccb6d54add7a76f2f955d15d0196Affected fe454dc31e84f8c14cb8942fcb61666c9f40745b to before c0acdee513239e1d6e1b490f56be0e6837dfd162Affected fe454dc31e84f8c14cb8942fcb61666c9f40745b to before 5cb34bb5fd726491b809efbeb5cfd63ae5bf9cf3Affected fe454dc31e84f8c14cb8942fcb61666c9f40745b to before 3ba6d01c4b3c584264dc733c6a2ecc5bbc8e0bb5Affected fe454dc31e84f8c14cb8942fcb61666c9f40745b to before 57f3cb6c84159d12ba343574df2115fb18dd83caAffected a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4Affected 5.10.20 to before 5.10.248Affected 5.11.3 to before 5.12Affected
LinuxLinux	5.12Affected before 5.12Not affected 5.10.248 through 5.10.Not affected 5.15.198 through 5.15.Not affected 6.1.160 through 6.1.Not affected 6.6.120 through 6.6.Not affected 6.12.64 through 6.12.Not affected 6.18.4 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

60d613b39e8d0c9f3b526e9c96445422b4562d76 to before d5ce588a9552878859a4d44b70b724216c188a5fAffected
fe454dc31e84f8c14cb8942fcb61666c9f40745b to before abf38398724ecc888f62c678d288da40d11878afAffected
fe454dc31e84f8c14cb8942fcb61666c9f40745b to before ab668a58c4a2ccb6d54add7a76f2f955d15d0196Affected
fe454dc31e84f8c14cb8942fcb61666c9f40745b to before c0acdee513239e1d6e1b490f56be0e6837dfd162Affected
fe454dc31e84f8c14cb8942fcb61666c9f40745b to before 5cb34bb5fd726491b809efbeb5cfd63ae5bf9cf3Affected
fe454dc31e84f8c14cb8942fcb61666c9f40745b to before 3ba6d01c4b3c584264dc733c6a2ecc5bbc8e0bb5Affected
fe454dc31e84f8c14cb8942fcb61666c9f40745b to before 57f3cb6c84159d12ba343574df2115fb18dd83caAffected
a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4Affected
5.10.20 to before 5.10.248Affected
5.11.3 to before 5.12Affected

LinuxLinux

5.12Affected
before 5.12Not affected
5.10.248 through 5.10.*Not affected
5.15.198 through 5.15.*Not affected
6.1.160 through 6.1.*Not affected
6.6.120 through 6.6.*Not affected
6.12.64 through 6.12.*Not affected
6.18.4 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.