CVE-2026-98253

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copy_to_user failure rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s the CMA multicast at the head of id_priv->mc_list. rdma_leave_multicast() matches only by sockaddr and destroys the first hit. ucma_process_join() used to drop ctx->mutex after a successful join and retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucma_multicast that the first thread frees. Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and, on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mc_list, and a leave-by-addr would destroy an earlier successful join.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98253

EUVD

EUVD-2026-93181

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	60d613b39e8d0c9f3b526e9c96445422b4562d76
Linux	Linux	fe454dc31e84f8c14cb8942fcb61666c9f40745b
Linux	Linux	fe454dc31e84f8c14cb8942fcb61666c9f40745b
Linux	Linux	fe454dc31e84f8c14cb8942fcb61666c9f40745b
Linux	Linux	fe454dc31e84f8c14cb8942fcb61666c9f40745b
Linux	Linux	fe454dc31e84f8c14cb8942fcb61666c9f40745b
Linux	Linux	fe454dc31e84f8c14cb8942fcb61666c9f40745b
Linux	Linux	fe454dc31e84f8c14cb8942fcb61666c9f40745b
Linux	Linux	a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4
Linux	Linux	5.10.20
Linux	Linux	5.11.3
Linux	Linux	5.12

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a race condition in the Linux kernel's RDMA/ucma module. It occurs when two concurrent JOIN_MCAST calls with the same address try to add entries to a list. The leave operation may incorrectly cancel the newer entry while the older one still tries to access freed memory, leading to potential use-after-free issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/ucma component and may not have direct network detection commands. Check kernel logs for RDMA-related errors or crashes using: dmesg | grep -i rdma or journalctl -k | grep -i rdma. Monitor for unusual multicast join/leave events in system logs.

Impact Analysis

This could cause system crashes, data corruption, or privilege escalation if exploited. Systems using RDMA (Remote Direct Memory Access) features are primarily affected, potentially leading to denial-of-service or unauthorized access in multi-user environments.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory management issue in the Linux RDMA subsystem. Compliance impacts would only occur if this flaw led to data breaches or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches to address this issue. If immediate patching is not possible, restrict access to RDMA services or disable them temporarily if not required. Monitor system stability and RDMA operations closely for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-98253. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70