CVE-2026-98154

nvme-rdma: fix -EIO cleanup order in queue_rq

State: Published
Severity: 7.0 High
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme-rdma: fix -EIO cleanup order in queue_rq

On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete.

Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	62eca39722fd997e3621fc903229917b9f0fb271 to before ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bbAffected 62eca39722fd997e3621fc903229917b9f0fb271 to before c2459519b39587c9c27d6b8a8cf516fee10fce66Affected 62eca39722fd997e3621fc903229917b9f0fb271 to before 965804b20c0f02c1a6cf4b69c0498a79e56f97feAffected 62eca39722fd997e3621fc903229917b9f0fb271 to before a41e7fc8d244d9cfc6273051aed85b67adedbb89Affected 62eca39722fd997e3621fc903229917b9f0fb271 to before cf3e706963ffbd3ee2568fa0d08ab016f0575ea8Affected 62eca39722fd997e3621fc903229917b9f0fb271 to before 171b993a4aed9889159df4815b6a6ba141e61975Affected 62eca39722fd997e3621fc903229917b9f0fb271 to before d61828199c6cb4b76d48403c77023cd4bb9d09fcAffected
LinuxLinux	5.12Affected before 5.12Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

62eca39722fd997e3621fc903229917b9f0fb271 to before ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bbAffected
62eca39722fd997e3621fc903229917b9f0fb271 to before c2459519b39587c9c27d6b8a8cf516fee10fce66Affected
62eca39722fd997e3621fc903229917b9f0fb271 to before 965804b20c0f02c1a6cf4b69c0498a79e56f97feAffected
62eca39722fd997e3621fc903229917b9f0fb271 to before a41e7fc8d244d9cfc6273051aed85b67adedbb89Affected
62eca39722fd997e3621fc903229917b9f0fb271 to before cf3e706963ffbd3ee2568fa0d08ab016f0575ea8Affected
62eca39722fd997e3621fc903229917b9f0fb271 to before 171b993a4aed9889159df4815b6a6ba141e61975Affected
62eca39722fd997e3621fc903229917b9f0fb271 to before d61828199c6cb4b76d48403c77023cd4bb9d09fcAffected

LinuxLinux

5.12Affected
before 5.12Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.