CVE-2026-97954

Received Received - Intake

Linux Kernel TCP Stream Corruption with Large Pages

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rds_message_map_pages() assigns PAGE_SIZE bytes to every scatterlist entry, even when total_len ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems with PAGE_SIZE greater than 8192 the scatterlist maps bytes beyond the end of the congestion map. RDS-TCP transmits the SG contents according to those lengths, so the extra bytes become part of the TCP RDS stream and are interpreted as subsequent RDS message headers, corrupting the stream. Limit the final scatterlist mapping to the number of bytes remaining. This has no effect on systems with a 4K page size and allows RDS-TCP to be used on systems with 16K and larger page sizes. The RDS selftest, which previously hung on 16K pages, now passes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97954

EUVD

EUVD-2026-86808

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the RDS (Reliable Datagram Sockets) TCP stream handling. When using large page sizes (greater than 8192 bytes), the scatterlist mapping assigns extra bytes beyond the intended congestion map size. These extra bytes corrupt the TCP RDS stream by being interpreted as subsequent message headers.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDS (Reliable Datagram Sockets) TCP implementation and may cause stream corruption on systems with PAGE_SIZE greater than 8192 bytes. Detection requires checking the kernel version and RDS module usage. Use 'uname -a' to verify kernel version and 'lsmod | grep rds' to check if RDS is loaded. Systems with PAGE_SIZE of 16K or larger are more likely affected.

Impact Analysis

This vulnerability can cause data corruption in RDS-TCP communications on systems with large page sizes (16K or larger). It may lead to application crashes, data loss, or misinterpretation of network messages, potentially disrupting services relying on RDS for reliable communication.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue causing TCP stream corruption in the RDS protocol on systems with large page sizes, which could lead to data integrity problems in network communications.

Mitigation Strategies

Apply the kernel patch that limits scatterlist mapping to remaining bytes. Update to a fixed kernel version where this issue is resolved. If using a custom kernel, backport the fix from the upstream commit. Disable RDS-TCP if not required by running 'rmmod rds_tcp' or blacklisting the module.

Hi! I’m here to help you understand CVE-2026-97954. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70