CVE-2026-98560
Received Received - Intake

Memory Leak in Linux Kernel RDS Connection Path Handling

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with __rds_conn_create() computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the loopback transport instead. That substitution is what an RDS/TCP socket sending to a local address gets, and after it the path init loop still runs for the TCP transport's RDS_MPATH_WORKERS paths and allocates an ordered workqueue for each, while rds_loop_conn_alloc() only ever provides transport data for path 0. rds_conn_destroy() sizes its teardown from c_trans, by then the loopback transport, so it visits path 0 only - and rds_conn_path_destroy() would skip the other paths anyway, since it returns before destroy_workqueue() for a path without transport data. kfree(c_path) then drops the last pointers to seven workqueues. That repeats for every such connection, on every netns teardown or module unload, and every distinct local destination address is a separate connection. Recompute npaths once the transport is final, so that creation and destruction agree on the set of paths. The c_path array stays sized for the caller's transport; the unused entries are freed with it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98560
EUVD
EUVD-2026-103605

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 4716af3897e95997d08183d351cece2dec9ee0c0
Linux Linux 4716af3897e95997d08183d351cece2dec9ee0c0
Linux Linux 7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect sizing of a connection's path set during transport selection. When an RDS/TCP socket sends data to a local address, the loopback transport is used instead of TCP. However, the path initialization loop still runs for the TCP transport's paths, leading to allocation of workqueues that are never properly managed. During teardown, only path 0 is processed, leaving other paths with unmanaged workqueues. Repeated connections cause memory leaks as workqueue pointers are lost.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDS (Reliable Datagram Sockets) implementation. Detection requires checking for kernel logs or system crashes related to RDS connections, particularly during network namespace teardown or module unloading. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability can lead to memory leaks in the Linux kernel, particularly when handling local network connections. Over time, repeated connections and disconnections may exhaust system memory, causing performance degradation or system instability. It primarily affects systems using the RDS protocol with TCP transport.

Compliance Impact

This vulnerability is a memory leak in the Linux kernel's RDS subsystem that occurs during netns teardown or module unload. It does not directly impact data confidentiality, integrity, or availability in a way that would affect GDPR or HIPAA compliance. The issue is limited to resource exhaustion during cleanup operations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel logs for RDS-related errors or crashes, especially during network operations. If using RDS over TCP, consider temporarily disabling RDS until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart