CVE-2026-98347
Received Received - Intake

Race Condition in Linux Kernel IPoIB Leading to Deadlock

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPER_UP after multicast flush ipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to prevent multicast joins while ipoib_mcast_dev_flush() is running, and restores the flag afterwards if it was previously set. This restore races with ipoib_ib_dev_down(). If the interface is brought down while the flush is in progress, ipoib_ib_dev_down() clears IPOIB_FLAG_OPER_UP, but the flush path may set it again after the device has already gone down. Since commit 894021a75291 ("IB/ipoib: Make the carrier_on_task race aware"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP being cleared to terminate its rtnl_trylock() retry loop. If the flag is left set after shutdown, the workqueue retries forever, causing teardown to deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while holding RTNL. Instead of overloading IPOIB_FLAG_OPER_UP to block multicast joins during a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag. Use it together with IPOIB_FLAG_OPER_UP to determine whether multicast joins are allowed, avoiding the race with device shutdown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98347
EUVD
EUVD-2026-93332

Affected Vendors & Products

Showing 21 associated CPEs
Vendor Product Version / Range
Linux Linux 344bacca8cd811809fc33a249f2738ab757d327f
Linux Linux 344bacca8cd811809fc33a249f2738ab757d327f
Linux Linux 344bacca8cd811809fc33a249f2738ab757d327f
Linux Linux 344bacca8cd811809fc33a249f2738ab757d327f
Linux Linux 344bacca8cd811809fc33a249f2738ab757d327f
Linux Linux 344bacca8cd811809fc33a249f2738ab757d327f
Linux Linux 344bacca8cd811809fc33a249f2738ab757d327f
Linux Linux 344bacca8cd811809fc33a249f2738ab757d327f
Linux Linux a289c65ca49d2680a3d797e633e57a45573d1df2
Linux Linux b81459c78935e4579a577b2366c5f8878d3c7fee
Linux Linux 8a9d8dc9ce83a90bfbbe69181acc4cf1beff46f5
Linux Linux dfe809702a11bd7fb91c882fb55620e39ce22109
Linux Linux 87160fb51bc343793cc8f5f031a87f1a35aecb82
Linux Linux 749fd55dd210f9676f0d445a6efaaa3bec65174a
Linux Linux 3.2.84
Linux Linux 3.10.105
Linux Linux 3.12.65
Linux Linux 3.16.39
Linux Linux 4.4.24
Linux Linux 4.7.7
Linux Linux 4.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the IPoIB (IP over InfiniBand) driver. The issue occurs when the interface is brought down during a multicast flush operation. The flush process may incorrectly restore the operational state flag after the device has already been shut down, causing a deadlock in the cleanup process.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPoIB (IP over InfiniBand) subsystem and may not have direct detection commands. Monitor for kernel logs indicating IPoIB interface issues or deadlocks during shutdown. Check for hung workqueues or rtnl_trylock() retry loops in kernel logs.

Impact Analysis

This vulnerability can cause system hangs or crashes during network interface shutdown, particularly in environments using InfiniBand or RoCE networks. It may lead to unresponsive systems or require manual intervention to recover from the deadlock state.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for the IPoIB multicast flush race condition. Avoid manual workarounds as they may not fully address the root cause.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98347. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart