CVE-2026-98257

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rds_conn_drop() on protocol version mismatch rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with conn->c_cm_lock held. When the peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls rds_conn_destroy(), which is only safe in the rmmod path: it synchronously tears the connection down and flush_work()es the shutdown work cp_down_w. That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is the very lock the event handler still holds, so the flush never completes: the two workers wait on each other and the RDS connection workqueues stall for good. All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR, DISCONNECTED) use rds_conn_drop(), which marks the connection RDS_CONN_ERROR and schedules the shutdown work asynchronously. Use it here as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98257

EUVD

EUVD-2026-93185

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	f147dd9ecabf23fd63d2562ffe64252a0453ecde
Linux	Linux	f147dd9ecabf23fd63d2562ffe64252a0453ecde
Linux	Linux	f147dd9ecabf23fd63d2562ffe64252a0453ecde
Linux	Linux	f147dd9ecabf23fd63d2562ffe64252a0453ecde
Linux	Linux	f147dd9ecabf23fd63d2562ffe64252a0453ecde
Linux	Linux	f147dd9ecabf23fd63d2562ffe64252a0453ecde
Linux	Linux	f147dd9ecabf23fd63d2562ffe64252a0453ecde
Linux	Linux	f147dd9ecabf23fd63d2562ffe64252a0453ecde
Linux	Linux	2.6.37

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a deadlock in the RDS (Reliable Datagram Sockets) over InfiniBand (IB) protocol. When a peer uses an older protocol version, the connection handling code incorrectly calls rds_conn_destroy() while holding a lock needed by the shutdown work, causing the system to stall indefinitely.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDS (Reliable Datagram Sockets) over InfiniBand (IB) implementation. Detection requires checking for stalled RDS connection workqueues due to protocol version mismatches. Monitor kernel logs for RDS-related errors or connection stalls. Check for hung tasks in the kernel using commands like 'cat /proc/sys/kernel/hung_task_timeout_secs' or 'dmesg | grep -i rds'. If connections stall, inspect workqueues with 'cat /proc/net/rds/debug' or 'rds-ping -c <ip>' to test connectivity.

Impact Analysis

This vulnerability can cause the RDS connection workqueues to stall, leading to a system hang or unresponsive network connections. It may disrupt services relying on RDS over InfiniBand, causing downtime or data transmission failures.

Compliance Impact

This vulnerability causes a denial-of-service condition by stalling RDS connection workqueues, which could disrupt network services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue by updating to a version where rds_conn_drop() is used instead of rds_conn_destroy() for protocol version mismatches.

Hi! I’m here to help you understand CVE-2026-98257. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70