CVE-2026-98252 RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
A race condition in the Linux kernel RDMA core allows a refcount bug, potentially leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98252?
CVE-2026-98252 is a high-severity vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail() making it accessible to global list where another CPU can kref_get() on nlmsg_request causing a refcount "addition on 0" bug. Fix this by initializing kref _before_ list_add_tail() so refcount for nlmsg_request can be incremented/decremented normally. In addition, also initialize every field before list_add_tail().
Which versions are affected by CVE-2026-98252?
How do I fix CVE-2026-98252?
Apply the vendor's patch.
Is CVE-2026-98252 being exploited?
There is no known exploitation of CVE-2026-98252 in the wild and no public exploit code.
Sources
Also known as AZL-106278, BELL-CVE-2026-98252, DEBIAN-CVE-2026-98252, GHSA-vh89-8c9p-vvg2, UBUNTU-CVE-2026-98252.