« Volver al listado

CVE-2026-98257

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

rds: ib: use rds_conn_drop() on protocol version mismatch

rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with conn->c_cm_lock held. When the peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls rds_conn_destroy(), which is only safe in the rmmod path: it synchronously tears the connection down and flush_work()es the shutdown work cp_down_w.

That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is the very lock the event handler still holds, so the flush never completes: the two workers wait on each other and the RDS connection workqueues stall for good.

Leer descripción completaMostrar menos

All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR, DISCONNECTED) use rds_conn_drop(), which marks the connection RDS_CONN_ERROR and schedules the shutdown work asynchronously. Use it here as well.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98257",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
              "lessThan": "424019be3f637da76b74f44a40034669acbb166f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
              "lessThan": "14fb90067d13f4494cff0f03243fae3cf2911cbc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
              "lessThan": "344c72a0bc2703a6de4918ed935850e07dae3af2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
              "lessThan": "b5c9f2951d330d4a198a64d6e60f79b4bd6ef078",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
              "lessThan": "d392b16acd0908f077289aad8bba066ff16de336",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
              "lessThan": "65ca0a5037152a5a80b8fe6aac80eb80458be573",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
              "lessThan": "7d8c22cb2cb1efb5e830a4545c76abf7b35cc2e8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f147dd9ecabf23fd63d2562ffe64252a0453ecde",
              "lessThan": "f97d8c7bab7843631206a114986c9059da03efeb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/rds/ib_cm.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.37"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.37",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/rds/ib_cm.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-06T09:18:14.540",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/14fb90067d13f4494cff0f03243fae3cf2911cbc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/344c72a0bc2703a6de4918ed935850e07dae3af2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/424019be3f637da76b74f44a40034669acbb166f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/65ca0a5037152a5a80b8fe6aac80eb80458be573",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7d8c22cb2cb1efb5e830a4545c76abf7b35cc2e8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b5c9f2951d330d4a198a64d6e60f79b4bd6ef078",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d392b16acd0908f077289aad8bba066ff16de336",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f97d8c7bab7843631206a114986c9059da03efeb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: use rds_conn_drop() on protocol version mismatch\n\nrds_ib_cm_connect_complete() runs from the RDMA-CM event handler with\nconn->c_cm_lock held.  When the peer negotiates a protocol version\nolder than RDS_PROTOCOL_COMPAT_VERSION, the handler calls\nrds_conn_destroy(), which is only safe in the rmmod path: it\nsynchronously tears the connection down and flush_work()es the\nshutdown work cp_down_w.\n\nThat shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is\nthe very lock the event handler still holds, so the flush never\ncompletes: the two workers wait on each other and the RDS connection\nworkqueues stall for good.\n\nAll other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,\nDISCONNECTED) use rds_conn_drop(), which marks the connection\nRDS_CONN_ERROR and schedules the shutdown work asynchronously.  Use\nit here as well."
    }
  ],
  "lastModified": "2026-10-06T09:18:14.540",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}