CVE-2026-45898 Overview
CVE-2026-45898 is a Linux kernel vulnerability in the RDMA/iwcm (iWARP Connection Manager) subsystem. The flaw causes workqueue list corruption due to incorrect work submission logic introduced by commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()"). The handler walks a work_list until empty, which can release work items back to the free list while the underlying workqueue entry is still queued. Reuse of the freed entry through INIT_WORK then corrupts the kernel workqueue's linked list. The condition was reproduced through stress testing with ucmatose on Intel E830 hardware in iWARP mode, triggering a kernel BUG at lib/list_debug.c:67.
Critical Impact
Triggering the bug results in a kernel BUG() and system instability on hosts using iWARP RDMA connections.
Affected Products
- Linux kernel branches containing commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()")
- Systems using RDMA/iwcm with iWARP-capable hardware such as the Intel E830
- Stable kernel trees prior to fixes 38c5b49, 7874eea, a6b9e79, and eb71513
Discovery Timeline
- 2026-05-27 - CVE-2026-45898 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45898
Vulnerability Analysis
The iWARP Connection Manager (iwcm) maintains a free list of struct iwcm_work objects, each embedding a struct work_struct. The commit e1168f0 modified cm_event_handler() to unconditionally call queue_work(), assuming the kernel would deduplicate already-pending work. That assumption is invalid here because every event acquires a distinct iwcm_work instance from the free list, so each queue_work() call enqueues a unique work_struct.
The work handler walks the iwcm-internal work_list and processes all queued items in a single invocation. When the handler processes entry N+1 inline and releases its memory back to the free list, the corresponding workqueue entry is still scheduled. A subsequent allocation reinitializes that memory via INIT_WORK(), leaving the kernel workqueue's internal linked list pointing at a reinitialized node. The next list operation hits __list_del_entry_valid_or_report and panics with list_del corruption. next->prev should be ....
Root Cause
The root cause is duplicated queueing state between the iwcm-owned work_list and the kernel workqueue's internal list, combined with premature recycling of iwcm_work objects [Kernel Workqueue Race]. The kernel workqueue already tracks pending work, so the auxiliary work_list is redundant and unsafe.
Attack Vector
The condition is reachable through high-rate iWARP connection management events. A local workload that drives many RDMA CM events, such as ucmatose stress testing, can trigger the corruption on systems exposing iWARP hardware. The fix removes the iwcm work_list entirely and relies on the kernel workqueue to track pending work, eliminating the double-tracking race.
No public exploit code is available. See the Kernel Git Commit 38c5b49 and Kernel Git Commit eb71513 for the upstream fixes.
Detection Methods for CVE-2026-45898
Indicators of Compromise
- Kernel log entries containing list_del corruption. next->prev should be originating from the iw_cm_wq workqueue
- Kernel BUG at lib/list_debug.c:67 with __list_del_entry_valid_or_report in the call trace
- Call traces including move_linked_works, __pwq_activate_work, pwq_dec_nr_in_flight, and process_scheduled_works
Detection Strategies
- Monitor dmesg and /var/log/kern.log for the workqueue list corruption signature shown above
- Inventory kernel versions on RDMA-enabled hosts and flag those containing commit e1168f0 without the listed fix commits
- Correlate unexpected kernel panics on hosts running iWARP workloads with RDMA CM event volume
Monitoring Recommendations
- Forward kernel logs from RDMA hosts to a centralized log store and alert on list_del corruption and kernel BUG strings
- Track crash dumps from systems using Intel iWARP NICs and compare against the call trace pattern above
- Audit workloads that exercise RDMA connection establishment at high rates for unexplained terminations
How to Mitigate CVE-2026-45898
Immediate Actions Required
- Apply the upstream kernel fixes referenced as 38c5b49, 7874eea, a6b9e79, and eb71513 once available in your distribution
- Identify hosts running iWARP-capable RDMA hardware and prioritize them for patching
- Restrict or throttle workloads that perform high-rate RDMA connection management on unpatched kernels
Patch Information
The fix removes the iwcm work_list and relies solely on the kernel workqueue to track pending work. Patch commits are available at Kernel Git Commit 38c5b49, Kernel Git Commit 7874eea, Kernel Git Commit a6b9e79, and Kernel Git Commit eb71513. Rebuild kernels from a stable tree containing these commits or install vendor packages incorporating them.
Workarounds
- Unload the iw_cm module on systems that do not require iWARP connectivity
- Disable iWARP on RDMA NICs where only RoCE or InfiniBand transports are needed
- Avoid running stress tools such as ucmatose against production iWARP endpoints until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
