---
title: "CVE-2026-100075: Linux Kernel - Denial of Service"
description: "Linux kernel contains a logic error in RDMA srpt_alloc_rw_ctxs() causing stale counters and dangling pointers, letting attackers cause incorrect send queue credit accounting, exploit requires triggering multi-buffer indirect descriptor failure."
url: https://panop.io/threat-heartbeat/CVE-2026-100075/
---

# CVE-2026-100075 Linux Kernel - Denial of Service

Linux kernel contains a logic error in RDMA srpt\_alloc\_rw\_ctxs() causing stale counters and dangling pointers, letting attackers cause incorrect send queue credit accounting, exploit requires triggering multi-buffer indirect descriptor failure.

CVSS base score 9.8 /10

Critical

CISA KEV

Not listed

Public exploit

None known

Authentication

Not required

EPSS

0.42% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-100075)

## Details

Type

Denial of Service

Impact

Denial Of Service

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

25 September 2026

Updated

15 October 2026

Weakness

[NVD-CWE-noinfo](https://cwe.mitre.org/data/definitions/NVD-CWE-noinfo.html)

## Vendor fix

Update to the latest Linux kernel version containing the fix for srpt\_alloc\_rw\_ctxs() unwind counters.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-100075](https://nvd.nist.gov/vuln/detail/CVE-2026-100075)
- [https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a](https://git.kernel.org/stable/c/be1478849e1abb1e12dc12e14cdbf800cc6fa99a)
- [https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f](https://git.kernel.org/stable/c/f1f2252da52cdda912da9993f39f58783b01b38f)
- [https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d](https://git.kernel.org/stable/c/f65f45dfa1e6e2eaa9e11c8b8ce8857799cb189d)
- [https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6](https://git.kernel.org/stable/c/717ab4d0614e9446bf8e2de6229464499e4008d6)
- [https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa](https://git.kernel.org/stable/c/af00051dbc9f467d4840ec709680660a3f8990fa)
- [https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a](https://git.kernel.org/stable/c/af073bd245180393bcb15d33d3990a6bdc32593a)
- [https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e](https://git.kernel.org/stable/c/b38f98e176050850f41bb6415f3a71400056623e)
- [https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95](https://git.kernel.org/stable/c/bd02d644bd19a2795c018635d273d91e45d2bb95)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)