# CVE-2026-97954: net/rds: fix tcp stream corruption with large pages

> An attacker can cause TCP stream corruption and potential denial of service in Linux RDS-TCP on systems with large page sizes.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 25 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-104421, BELL-CVE-2026-97954, DEBIAN-CVE-2026-97954, GHSA-hh3g-f497-67jw, UBUNTU-CVE-2026-97954

## What is CVE-2026-97954?

CVE-2026-97954 is a denial of service vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: fix tcp stream corruption with large pages

rds_message_map_pages() assigns PAGE_SIZE bytes to every
scatterlist entry, even when total_len ends in a partial page. The RDS
congestion map is defined as 8192 bytes, so on systems with PAGE_SIZE
greater than 8192 the scatterlist maps bytes beyond the end of the
congestion map.  RDS-TCP transmits the SG contents according to those
lengths, so the extra bytes become part of the TCP RDS stream and are
interpreted as subsequent RDS message headers, corrupting the stream.

Limit the final scatterlist mapping to the number of bytes remaining.
This has no effect on systems with a 4K page size and allows RDS-TCP to
be used on systems with 16K and larger page sizes.

The RDS selftest, which previously hung on 16K pages, now passes.

## Which versions are affected by CVE-2026-97954?


## How do I fix CVE-2026-97954?

Apply the vendor's patch.

## Is CVE-2026-97954 being exploited?

There is no known exploitation of CVE-2026-97954 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-97954 and fix it if it is affected.

What it is: CVE-2026-97954 is a denial of service vulnerability in Linux, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-97954 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-97954/ (Markdown: https://insights.sbomify.com/CVE-2026-97954/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-97954
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97954
- OSV: https://osv.dev/vulnerability/CVE-2026-97954

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-97954/
Summaries are generated and may contain mistakes; the official description above is the record.