CVE-2026-97477

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()<br /> <br /> When __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path<br /> jumps to err_mode which frees the counter without decrementing<br /> port_counter-&gt;num_counters. The only place that decrements is<br /> rdma_counter_free(), which is unreachable since the counter was never<br /> successfully bound.<br /> <br /> This leak accumulates across repeated failures, permanently preventing<br /> the port from switching to AUTO mode (-EBUSY in __counter_set_mode())<br /> and blocking the MANUAL→NONE auto-revert in rdma_counter_free(). When<br /> the mode was NONE before the call, the MANUAL mode set by<br /> __counter_set_mode() also leaks since the revert logic is never<br /> reached.<br /> <br /> Add an err_bind label between the num_counters increment and the<br /> existing err_mode label. It decrements num_counters and mirrors the<br /> MANUAL→NONE revert from rdma_counter_free(), ensuring the port state<br /> is fully restored on bind failure.