{"id":"CVE-2026-43469","revision":"c3cadca6c84845b8954f2decd6795ec3","records":[{"revision":"c3cadca6c84845b8954f2decd6795ec3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43469","aliases":[],"title":"xprtrdma: Decrement re_receiving on the early exit paths","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Decrement re_receiving on the early exit paths\n\nIn the event that rpcrdma_post_recvs() fails to create a work request\n(due to memory allocation failure, say) or otherwise exits early, we\nshould decrement ep->re_receiving before returning. Otherwise we will\nhang in rpcrdma_xprt_drain() as re_receiving will never reach zero and\nthe completion will never be triggered.\n\nOn a system with high memory pressure, this can appear as the following\nhung task:\n\n INFO: task kworker/u385:17:8393 blocked for more than 122 seconds.\n Tainted: G S E 6.19.0 #3\n \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/u385:17 state:D stack:0 pid:8393 tgid:8393 ppid:2 task_flags:0x4248060 flags:0x00080000\n Workqueue: xprtiod xprt_autoclose [sunrpc]\n Call Trace:\n \n __schedule+0x48b/0x18b0\n ? ib_post_send_mad+0x247/0xae0 [ib_core]\n schedule+0x27/0xf0\n schedule_timeout+0x104/0x110\n __wait_for_common+0x98/0x180\n ? __pfx_schedule_timeout+0x10/0x10\n wait_for_completion+0x24/0x40\n rpcrdma_xprt_disconnect+0x444/0x460 [rpcrdma]\n xprt_rdma_close+0x12/0x40 [rpcrdma]\n xprt_autoclose+0x5f/0x120 [sunrpc]\n process_one_work+0x191/0x3e0\n worker_thread+0x2e3/0x420\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x10d/0x230\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x273/0x2b0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30","state":0,"publishedAt":"2026-05-08T14:22:29.55+00:00","modifiedAt":"2026-10-19T19:26:37.543+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/sunrpc/xprtrdma/verbs.c\"\n ],\n \"versions\": [\n {\n \"version\": \"15788d1d1077ebe029c48842c738876516d85076\",\n \"lessThan\": \"7ea69259a60a364f56cf4aa9e2eafb588d1c762b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"15788d1d1077ebe029c48842c738876516d85076\",\n \"lessThan\": \"8cb6b5d8296b1f99a8d36849901ebabfe3f749db\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"15788d1d1077ebe029c48842c738876516d85076\",\n \"lessThan\": \"74c39a47856bddcde7874f2196a00143b5cd0af9\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"15788d1d1077ebe029c48842c738876516d85076\",\n \"lessThan\": \"49f53ee4e25297d886f14e31f355ad1c2735ddfb\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"15788d1d1077ebe029c48842c738876516d85076\",\n \"lessThan\": \"8127b5fec04757c2a41ed65bca0b3266968efd3b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"15788d1d1077ebe029c48842c738876516d85076\",\n \"lessThan\": \"dc3ebd7e2d73dbd4d317785735ffa6c4a6384ddf\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"15788d1d1077ebe029c48842c738876516d85076\",\n \"lessThan\": \"7b6275c80a0c81c5f8943272292dfe67730ce849\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/sunrpc/xprtrdma/verbs.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.13\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.13\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.203\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.167\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.130\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.78\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.19\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.19.9\",\n \"lessThanOrEqual\": \"6.19.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.0\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/7ea69259a60a364f56cf4aa9e2eafb588d1c762b","https://git.kernel.org/stable/c/8cb6b5d8296b1f99a8d36849901ebabfe3f749db","https://git.kernel.org/stable/c/74c39a47856bddcde7874f2196a00143b5cd0af9","https://git.kernel.org/stable/c/49f53ee4e25297d886f14e31f355ad1c2735ddfb","https://git.kernel.org/stable/c/8127b5fec04757c2a41ed65bca0b3266968efd3b","https://git.kernel.org/stable/c/dc3ebd7e2d73dbd4d317785735ffa6c4a6384ddf","https://git.kernel.org/stable/c/7b6275c80a0c81c5f8943272292dfe67730ce849"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43469","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43469","identifiers":["CVE-2026-43469"]},"retained":false,"historicalAffected":[]}],"coverage":[]}