Incomplete cleanup in Linux kernel - CVE-2026-100075
Published: September 28, 2026
Vulnerability identifier: #VU152272
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-100075
CWE-ID: CWE-459
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause incorrect send queue credit accounting.
The vulnerability exists due to incomplete cleanup in the srpt_alloc_rw_ctxs() error unwind path when handling an allocation failure partway through a multi-buffer indirect descriptor. A remote attacker can trigger the error path to cause incorrect send queue credit accounting.
Affected software
Linux kernel
How to mitigate CVE-2026-100075
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6
- https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa
- https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a
- https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e
- https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95
- https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a
- https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f
- https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d