---
id: CVE-2026-90415
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/cxgb4: free STAG index when TPT entry write fails

  write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and
  bumps stats.stag.cur before programmin…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/cxgb4: free STAG index when TPT entry write fails

  write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and
  bumps stats.stag.cur before programmin…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec3eead217181d7360a11317a888ceb30807867c <
    5fe4731bfbd8d83c4a14b4af3a27329969ce8a99
  - >-
    Linux >= ec3eead217181d7360a11317a888ceb30807867c <
    8f6976d635d190e3d7af7103daaa581cf1ccc12e
  - >-
    Linux >= ec3eead217181d7360a11317a888ceb30807867c <
    9eeafcda1d6c11f0eec532243c4e96ec8c632bd7
  - >-
    Linux >= ec3eead217181d7360a11317a888ceb30807867c <
    5a21e5114cec4cd3f8a2843d4c46bc49634d6e96
  - >-
    Linux >= ec3eead217181d7360a11317a888ceb30807867c <
    2f17ca7ab5269ac2504e1039c3921373dccd7712
  - >-
    Linux >= ec3eead217181d7360a11317a888ceb30807867c <
    a2e37d1ab773be3cd26b1c19593ca2dbcece9c57
  - >-
    Linux >= ec3eead217181d7360a11317a888ceb30807867c <
    a64e2beb450179a5d43034af8d5476a11eac1486
  - >-
    Linux >= ec3eead217181d7360a11317a888ceb30807867c <
    fdfb5cea4bf070cdb31d997efd87bb684df041fd
  - Linux 3.5
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:45.647'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90415'
references:
  - url: 'https://git.kernel.org/stable/c/2f17ca7ab5269ac2504e1039c3921373dccd7712'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5a21e5114cec4cd3f8a2843d4c46bc49634d6e96'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5fe4731bfbd8d83c4a14b4af3a27329969ce8a99'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8f6976d635d190e3d7af7103daaa581cf1ccc12e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9eeafcda1d6c11f0eec532243c4e96ec8c632bd7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a2e37d1ab773be3cd26b1c19593ca2dbcece9c57'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a64e2beb450179a5d43034af8d5476a11eac1486'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fdfb5cea4bf070cdb31d997efd87bb684df041fd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.796Z'
epss: 0.00177
epssPercentile: 0.06396
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cxgb4: free STAG index when TPT entry write fails

write_tpt_entry() allocates a new STAG index with c4iw_get_resource() and
bumps stats.stag.cur before programming the entry.  When
write_adapter_mem() fails, it returns the error without releasing the index
or reversing the statistic.  No MR is inserted into rhp->mrs, so
deregistration never reclaims it, leaking the index until device teardown.

Record whether this call allocated the index and, on a failed write, return
it to tpt_table and decrement stats.stag.cur.  Key the rollback on both the
write error and that flag, not the error alone: a non-reset update carries
a caller-owned STAG that this call did not allocate and must not free.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.