CVE-2026-98257 rds: ib: use rds_conn_drop() on protocol version mismatch
A deadlock in the Linux kernel RDS InfiniBand driver causes a permanent stall of connection workqueues when a protocol version mismatch occurs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98257?
CVE-2026-98257 is a high-severity denial of service vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rds: ib: use rds_conn_drop() on protocol version mismatch
rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with conn->c_cm_lock held. When the peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls rds_conn_destroy(), which is only safe in the rmmod path: it synchronously tears the connection down and flush_work()es the shutdown work cp_down_w.
That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is the very lock the event handler still holds, so the flush never completes: the two workers wait on each other and the RDS connection workqueues stall for good.
All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR, DISCONNECTED) use rds_conn_drop(), which marks the connection RDS_CONN_ERROR and schedules the shutdown work asynchronously. Use it here as well.
Which versions are affected by CVE-2026-98257?
How do I fix CVE-2026-98257?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98257 being exploited?
There is no known exploitation of CVE-2026-98257 in the wild and no public exploit code.
Sources
Also known as AZL-106431, BELL-CVE-2026-98257, DEBIAN-CVE-2026-98257, GHSA-36mq-8633-f579, UBUNTU-CVE-2026-98257.