CVE-2026-98253 Overview
CVE-2026-98253 is a race condition in the Linux kernel's RDMA userspace Connection Manager Agent (ucma) subsystem. The flaw occurs in ucma_process_join(), which previously dropped ctx->mutex after a successful join and reacquired it only when copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same socket address can insert a second CMA multicast entry before the first thread's leave operation runs. The subsequent rdma_leave_multicast() matches by sockaddr and destroys the newer entry, leaving the older worker to dereference a freed ucma_multicast structure. The result is a local use-after-free affecting confidentiality, integrity, and availability on hosts with RDMA/RoCE support.
Critical Impact
A local user with access to the RDMA ucma character device can trigger a use-after-free in kernel context, enabling potential privilege escalation or kernel memory corruption.
Affected Products
- Linux kernel builds with CONFIG_INFINIBAND_USER_ACCESS enabled exposing /dev/infiniband/rdma_cm
- RoCE/InfiniBand-capable systems running stable kernel branches prior to the fix commits
- Distribution kernels inheriting the vulnerable drivers/infiniband/core/ucma.c code path
Discovery Timeline
- 2026-10-06 - CVE-2026-98253 published to NVD
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-98253
Vulnerability Analysis
The rdma_join_multicast() function queues RoCE work that later reads a ucma_multicast object through event->param.ud.private_data. After the join completes, the CMA multicast structure is inserted at the head of id_priv->mc_list. The matching teardown routine, rdma_leave_multicast(), locates the entry only by sockaddr and destroys the first match.
Before the fix, ucma_process_join() released ctx->mutex once the join succeeded. The mutex was reacquired only when copy_to_user() returned -EFAULT. During that unlocked window a second thread issuing JOIN_MCAST with an identical address could complete another join and push a newer CMA entry onto mc_list. When the first thread then invoked leave to clean up its copy_to_user() failure, the sockaddr-based lookup matched the newer entry and freed it. The queued worker associated with the original join subsequently dereferenced the already-freed ucma_multicast, producing a use-after-free in kernel memory.
Root Cause
The root cause is improper serialization between join and leave operations in the ucma code path. Dropping ctx->mutex across the copy_to_user() call allowed a race between concurrent multicast join requests. Combined with sockaddr-only matching in rdma_leave_multicast(), this permitted the wrong CMA entry to be destroyed.
Attack Vector
The attack requires local access and the ability to open the rdma_cm character device, typically available to users in a privileged group or in containers that expose RDMA devices. An attacker executes two concurrent RDMA_USER_CM_CMD_JOIN_MCAST ioctls targeting the same multicast address while forcing copy_to_user() to fail on one thread, for example by passing an unmapped user buffer. The resulting race frees the wrong ucma_multicast, and the queued RoCE worker dereferences the stale pointer. See the upstream fix commits for the exact code paths and reproducer context in the kernel changelog.
Detection Methods for CVE-2026-98253
Indicators of Compromise
- Kernel oops or panic logs referencing ucma_process_join, rdma_leave_multicast, or ucma_multicast in the stack trace
- KASAN use-after-free reports naming slab objects allocated in drivers/infiniband/core/ucma.c
- Unexpected process terminations or SIGBUS/SIGSEGV from userspace RDMA clients coinciding with kernel warnings
Detection Strategies
- Enable KASAN in test or canary kernels to surface use-after-free conditions in the RDMA subsystem before production exposure
- Audit /dev/infiniband/rdma_cm access and alert on non-RDMA workloads opening the device
- Correlate repeated JOIN_MCAST ioctl calls from the same PID with kernel ring-buffer warnings
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log to a centralized log pipeline and alert on RDMA/ucma stack traces
- Track auditd SYSCALL events for ioctl on InfiniBand device nodes by non-service accounts
- Monitor container runtimes for workloads requesting RDMA device passthrough
How to Mitigate CVE-2026-98253
Immediate Actions Required
- Apply the upstream stable kernel patches that keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and across rdma_leave_multicast() on -EFAULT
- Restrict access to /dev/infiniband/rdma_cm to only trusted service accounts that require RDMA connectivity
- Rebuild or redeploy kernels on hosts providing RDMA to multi-tenant workloads first
Patch Information
The fix is distributed across multiple stable branch commits, including 01cbdb7, 01e29d0d, 29b9ed83, 43c4e24b, 52172e11, 662ade4d, 83610ee5, and ae805d20. The patches keep the context mutex held across the user-copy and ensure leave is skipped when join itself failed, preventing destruction of an unrelated earlier successful join.
Workarounds
- Unload the rdma_ucm kernel module on hosts that do not require userspace RDMA connection management: modprobe -r rdma_ucm
- Remove or tighten permissions on /dev/infiniband/rdma_cm to block unprivileged local users
- Disable RDMA device passthrough into untrusted containers until kernels are patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.