CVE-2026-98069: Linux Kernel Race Condition Vulnerability

CVE-2026-98069 Overview

CVE-2026-98069 is a race condition in the Linux kernel's Reliable Datagram Sockets (RDS) networking subsystem. The flaw resides in rds_conn_shutdown(), which quiesces the transmit and receive-refill paths by waiting for the RDS_IN_XMIT and RDS_RECV_REFILL bits to be sampled clear before running transport shutdown and rds_conn_path_reset(). Sampling a bit clear is not the same as owning it, so rds_send_xmit() or rds_ib_recv_refill() can re-acquire the bit and run concurrently with teardown. On weakly ordered architectures, both sides can miss each other's writes, producing a classic store-buffering race between the sender and the teardown path.

Critical Impact
Concurrent execution of the RDS transmit path and connection teardown can trigger BUG_ON() assertions, dereference NULL pointers in rds_ib_send_cqe_handler(), and corrupt transport state during InfiniBand or TCP failover.

Affected Products

Linux kernel (upstream) containing the net/rds subsystem
Stable kernel branches referenced by the fix commits 1fe627e, 7febb11, 813f358, and 900e96c
Distributions that ship RDS over TCP or InfiniBand (for example Oracle UEK, which previously patched the same class of crash)

Discovery Timeline

2026-09-25 - CVE-2026-98069 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98069

Vulnerability Analysis

The RDS connection teardown logic relies on wait_event() to observe RDS_IN_XMIT and RDS_RECV_REFILL cleared, then proceeds to tear down transport rings and reset path state. Nothing prevents a sender from re-acquiring RDS_IN_XMIT immediately after the wait returns. The sender rechecks the connection state after taking the lock, but acquire_in_xmit() is only an acquire operation, so the teardown's state write and the sender's bit write can be reordered relative to each other's reads.

Under that reordering, rds_send_xmit() executes while rds_ib_ring_init() zeroes transport rings and rds_send_path_reset() rewrites transmit state. The result is memory corruption of ring structures, unexpected completion-queue opcodes, and NULL dereferences during failover testing. Oracle UEK addressed the same bug class in its "rds: Make sure transmit path and connection tear-down does not run concurrently" fix, which the upstream patches now mirror.

Root Cause

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race combined with insufficient memory ordering. rds_conn_shutdown() tests the fastpath bits instead of acquiring them. Because ownership of a single word is decided by read-modify-write atomicity, treating bit sampling as mutual exclusion is incorrect on weakly ordered architectures.

Attack Vector

The condition is reachable over the network because RDS connection state transitions follow link events such as InfiniBand failover and TCP SYN handling in rds_tcp_accept_one(). An attacker or adversarial network condition that forces repeated connection resets while traffic is in flight can widen the race window and trigger the corruption. Successful exploitation of the race yields kernel crashes and potential memory corruption affecting confidentiality, integrity, and availability.

See the upstream patches for implementation detail: Kernel Git Commit 1fe627e, Kernel Git Commit 7febb11, Kernel Git Commit 813f358, and Kernel Git Commit 900e96c.

Detection Methods for CVE-2026-98069

Indicators of Compromise

Kernel BUG_ON() panics originating in rds_ib_sub_signaled() or rds_ib_send_cqe_handler().
NULL pointer dereference oopses in the RDS send completion path during InfiniBand failover or TCP reconnect.
Unexpected RDS work-request opcodes logged by rds_ib_send_cqe_handler() after connection resets.

Detection Strategies

Monitor kernel ring buffer and /var/log/messages for RDS-related oops and WARN_ON traces following link events.
Correlate RDS connection reset counts with host reboots or crash dumps on nodes running RDS over IB or TCP.
Audit loaded modules for rds, rds_tcp, and rds_rdma on hosts that do not require RDS, since unused modules represent unnecessary attack surface.

Monitoring Recommendations

Enable kdump on RDS-using hosts to capture crash state for post-mortem analysis of race-condition panics.
Centralize kernel logs and alert on recurring RDS stack frames across the fleet.
Track installed kernel versions against the fixed stable commits to confirm patch rollout coverage.

How to Mitigate CVE-2026-98069

Immediate Actions Required

Apply the stable kernel updates containing commits 1fe627e, 7febb11, 813f358, or 900e96c from your distribution vendor.
Inventory hosts that load the rds, rds_tcp, or rds_rdma modules and prioritize patching for InfiniBand fabrics and HPC clusters.
Reboot patched hosts to activate the fixed kernel, since the RDS subsystem is built in-tree or auto-loaded on demand.

Patch Information

The upstream fix changes rds_conn_shutdown() to acquire both fastpath bit locks before invoking transport shutdown, holds them across rds_conn_path_reset(), and releases them with clear_bit_unlock() to establish release ordering. Fastpath callers rds_send_xmit() and rds_ib_recv_refill() remain trylock style and back off while teardown owns the locks. Backports are available in the stable tree via the four referenced git commits.

Workarounds

Blacklist the RDS modules on systems that do not use RDS by adding install rds /bin/true to a file under /etc/modprobe.d/.
Avoid repeated forced failovers and connection resets on RDS fabrics until patched kernels are deployed.
Restrict network reachability to RDS-enabled hosts so only trusted peers can trigger connection state transitions.

bash

# Disable the RDS subsystem on hosts that do not require it
echo 'install rds /bin/true'      | sudo tee /etc/modprobe.d/disable-rds.conf
echo 'install rds_tcp /bin/true'  | sudo tee -a /etc/modprobe.d/disable-rds.conf
echo 'install rds_rdma /bin/true' | sudo tee -a /etc/modprobe.d/disable-rds.conf
sudo rmmod rds_rdma rds_tcp rds 2>/dev/null || true