CVE-2026-93037
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Propagate sdma_txinit_ahg() errors set_txreq_header_ahg() ignores the return value of sdma_txinit_ahg(). If sdma_txinit_ahg() fails, it returns before initializing tx->txreq. However, set_txreq_header_ahg() ignores the error and returns the AHG change count, causing the caller to continue processing the request as though initialization had succeeded. Propagate sdma_txinit_ahg() failures to the caller and abort request processing when initialization fails. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-17 17:17:56.750000
Last modified
2026-10-19 10:16:53.280000
View original CVE JSON
{
"id": "CVE-2026-93037",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-17T17:17:56.750",
"lastModified": "2026-10-19T10:16:53.280",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hfi1: Propagate sdma_txinit_ahg() errors\n\nset_txreq_header_ahg() ignores the return value of sdma_txinit_ahg().\n\nIf sdma_txinit_ahg() fails, it returns before initializing tx->txreq.\nHowever, set_txreq_header_ahg() ignores the error and returns the AHG\nchange count, causing the caller to continue processing the request as\nthough initialization had succeeded.\n\nPropagate sdma_txinit_ahg() failures to the caller and abort request\nprocessing when initialization fails.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/infiniband/hw/hfi1/user_sdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
"lessThan": "cb73c2fe6e9cf563c99f22b7c8bca0d5f70d603e",
"versionType": "git",
"status": "affected"
},
{
"version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
"lessThan": "122a730675565ff2ad210537c3fc3afb8291d482",
"versionType": "git",
"status": "affected"
},
{
"version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
"lessThan": "bf974994150cfd14bfc599748925f4d426e00d90",
"versionType": "git",
"status": "affected"
},
{
"version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
"lessThan": "fd6dee13f3857259b6b2ddd28e1ed95fd94ae2f9",
"versionType": "git",
"status": "affected"
},
{
"version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
"lessThan": "5b7cefffd15d87c8103865f887cdcf9077d8094b",
"versionType": "git",
"status": "affected"
},
{
"version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
"lessThan": "3416db552eb378e54cb2f2ce0db5f0df88654bda",
"versionType": "git",
"status": "affected"
},
{
"version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
"lessThan": "ca99431820e8cac19f6a091c04da54cbe8d64f52",
"versionType": "git",
"status": "affected"
},
{
"version": "e3304b7cc4f14d365f46d6847a35563ae8b017f7",
"lessThan": "091c6162c022cbdfb64219708a71728cfd1d4600",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/infiniband/hw/hfi1/user_sdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.14",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.14",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.270",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.221",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.157",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.110",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.52",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.6",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/091c6162c022cbdfb64219708a71728cfd1d4600",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/122a730675565ff2ad210537c3fc3afb8291d482",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3416db552eb378e54cb2f2ce0db5f0df88654bda",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5b7cefffd15d87c8103865f887cdcf9077d8094b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bf974994150cfd14bfc599748925f4d426e00d90",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ca99431820e8cac19f6a091c04da54cbe8d64f52",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cb73c2fe6e9cf563c99f22b7c8bca0d5f70d603e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fd6dee13f3857259b6b2ddd28e1ed95fd94ae2f9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}