In the Linux kernel, the following vulnerability has been resolved:

rds: ib: use rds_conn_drop() on protocol version mismatch

rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with
conn->c_cm_lock held. When the peer negotiates a protocol version
older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls
rds_conn_destroy(), which is only safe in the rmmod path: it
synchronously tears the connection down and flush_work()es the
shutdown work cp_down_w.

That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is
the very lock the event handler still holds, so the flush never
completes: the two workers wait on each other and the RDS connection
workqueues stall for good.

All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,
DISCONNECTED) use rds_conn_drop(), which marks the connection
RDS_CONN_ERROR and schedules the shutdown work asynchronously. Use
it here as well.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/14fb90067d13f4494cff0f03243fae3cf2911cbc cve-icon cve-icon
https://git.kernel.org/stable/c/344c72a0bc2703a6de4918ed935850e07dae3af2 cve-icon cve-icon
https://git.kernel.org/stable/c/424019be3f637da76b74f44a40034669acbb166f cve-icon cve-icon
https://git.kernel.org/stable/c/65ca0a5037152a5a80b8fe6aac80eb80458be573 cve-icon cve-icon
https://git.kernel.org/stable/c/7d8c22cb2cb1efb5e830a4545c76abf7b35cc2e8 cve-icon cve-icon
https://git.kernel.org/stable/c/b5c9f2951d330d4a198a64d6e60f79b4bd6ef078 cve-icon cve-icon
https://git.kernel.org/stable/c/d392b16acd0908f077289aad8bba066ff16de336 cve-icon cve-icon
https://git.kernel.org/stable/c/f97d8c7bab7843631206a114986c9059da03efeb cve-icon cve-icon
History

Tue, 06 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-247
CWE-413

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rds_conn_drop() on protocol version mismatch rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with conn->c_cm_lock held. When the peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls rds_conn_destroy(), which is only safe in the rmmod path: it synchronously tears the connection down and flush_work()es the shutdown work cp_down_w. That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is the very lock the event handler still holds, so the flush never completes: the two workers wait on each other and the RDS connection workqueues stall for good. All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR, DISCONNECTED) use rds_conn_drop(), which marks the connection RDS_CONN_ERROR and schedules the shutdown work asynchronously. Use it here as well.
Title rds: ib: use rds_conn_drop() on protocol version mismatch
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-06T08:45:22.722Z

Reserved: 2026-09-25T10:25:14.332Z

Link: CVE-2026-98257

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-06T09:18:14.540

Modified: 2026-10-06T09:18:14.540

Link: CVE-2026-98257

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T12:45:17Z

Weaknesses