{"id":"AZL-103781","summary":"CVE-2026-97477 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()\n\nWhen __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path\njumps to err_mode which frees the counter without decrementing\nport_counter-\u003enum_counters. The only place that decrements is\nrdma_counter_free(), which is unreachable since the counter was never\nsuccessfully bound.\n\nThis leak accumulates across repeated failures, permanently preventing\nthe port from switching to AUTO mode (-EBUSY in __counter_set_mode())\nand blocking the MANUAL→NONE auto-revert in rdma_counter_free(). When\nthe mode was NONE before the call, the MANUAL mode set by\n__counter_set_mode() also leaks since the revert logic is never\nreached.\n\nAdd an err_bind label between the num_counters increment and the\nexisting err_mode label. It decrements num_counters and mirrors the\nMANUAL→NONE revert from rdma_counter_free(), ensuring the port state\nis fully restored on bind failure.","modified":"2026-09-25T14:15:47.464281670Z","published":"2026-09-24T17:17:25Z","upstream":["CVE-2026-97477"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97477"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103781.json"}}],"schema_version":"1.9.0"}