CVE-2025-71084None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
RDMA/cm: Fix leaking the multicast GID table reference
If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr. This leaks a refcount and triggers a WARN:
GID entry ref leak for dev syz1 index 2 ref=573 WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline] WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
Destroy the ah_attr after canceling the work, it is safe to call this twice.
Linux >= 60d613b39e8d0c9f3b526e9c96445422b4562d76 < d5ce588a9552878859a4d44b70b724216c188a5fLinux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < abf38398724ecc888f62c678d288da40d11878afLinux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < ab668a58c4a2ccb6d54add7a76f2f955d15d0196Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < c0acdee513239e1d6e1b490f56be0e6837dfd162Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 5cb34bb5fd726491b809efbeb5cfd63ae5bf9cf3Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 3ba6d01c4b3c584264dc733c6a2ecc5bbc8e0bb5Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 57f3cb6c84159d12ba343574df2115fb18dd83caLinux a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4Linux >= 5.10.20 < 5.10.248Linux >= 5.11.3 < 5.12Linux 5.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets