{"cve":"CVE-2026-93104","nvd":{"published":"2026-09-17T17:18:04.740","modified":"2026-10-21T13:20:59.597","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rvt: Return NULL after port allocation failure\n\nrvt_alloc_device() deallocates the IB device when its port array cannot\nbe allocated but then returns the pointer to the released allocation.\nCallers treat any non-NULL value as valid and dereference it, resulting\nin a use-after-free.\n\nReturn NULL immediately after deallocation so callers can propagate the\nallocation failure.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/2982eaf3b9d2d953318c74cd6f1b7576ea6d7b1f","https://git.kernel.org/stable/c/5a1a7a5e2fe1a15824fa9ae5edd8f008259471d1","https://git.kernel.org/stable/c/80968b42d13080bf7bc1f3ee17fef126ce2ad98f","https://git.kernel.org/stable/c/b1e1b25723af44328524c7b54433e4bf0ab9930c","https://git.kernel.org/stable/c/b7129930d1ec46c03a0de07fdce6c29f75795006"],"products":[],"source":"nvd","synced_at":"2026-10-22T16:41:11.231219466+00:00"},"epss":{"cve":"CVE-2026-93104","score":0.00174,"percentile":0.0684,"date":"2026-10-26"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}