CVE-2026-98257: Linux Kernel RDS IB Race Condition Flaw

CVE-2026-98257 Overview

CVE-2026-98257 is a Linux kernel vulnerability in the Reliable Datagram Sockets (RDS) InfiniBand transport. The flaw resides in rds_ib_cm_connect_complete(), which runs from the RDMA Connection Manager (RDMA-CM) event handler while holding conn->c_cm_lock. When a peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls rds_conn_destroy(), which synchronously tears the connection down and flushes shutdown work that requires the same lock. The two workers wait on each other, stalling the RDS connection workqueues indefinitely.

Critical Impact
A remote peer can trigger a kernel workqueue deadlock by negotiating an incompatible RDS protocol version over RDMA, causing denial of service on affected hosts.

Affected Products

Linux kernel versions containing the vulnerable rds_ib_cm_connect_complete() code path prior to the fix
Systems using RDS over InfiniBand (RDS-IB) transport
Hosts with RDMA-CM enabled for RDS connections

Discovery Timeline

2026-10-06 - CVE-2026-98257 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-98257

Vulnerability Analysis

The vulnerability is a kernel-level deadlock in the RDS-IB transport. rds_ib_cm_connect_complete() executes inside the RDMA-CM event handler context with conn->c_cm_lock held. When the connecting peer advertises a protocol version below RDS_PROTOCOL_COMPAT_VERSION, the function invokes rds_conn_destroy().

rds_conn_destroy() is only safe during module unload. It synchronously tears down the connection and calls flush_work() on the shutdown worker cp_down_w. That shutdown handler, rds_conn_shutdown(), also needs cp_cm_lock. Because the event handler still holds the lock, the flush never completes.

The two workers wait on each other, producing a persistent deadlock. All RDS connection workqueues on the affected host stall for the lifetime of the system or until manual intervention.

Root Cause

The root cause is improper synchronization between a connection teardown path and the lock held by its caller. rds_conn_destroy() performs a synchronous flush of work that re-acquires cp_cm_lock, while the caller holds that lock. This classic AB-BA style wait between two kernel workers constitutes a deadlock condition under resource exhaustion [CWE-833]. Other RDMA-CM failure paths — REJECTED, CONNECT_ERROR, and DISCONNECTED — correctly use rds_conn_drop(), which marks the connection RDS_CONN_ERROR and schedules shutdown asynchronously.

Attack Vector

The attack vector is network-based with no authentication or user interaction required. A remote system establishing an RDS-IB connection and negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION triggers the vulnerable code path. Exploitation does not yield code execution or data disclosure; it causes availability loss by freezing RDS workqueues on the target. See the upstream fix in Kernel Git Commit 14fb900 and related backports for technical details.

Detection Methods for CVE-2026-98257

Indicators of Compromise

Hung task warnings in dmesg referencing rds_connect_worker, rds_shutdown_worker, or rds_ib_cm_connect_complete.
RDS connection state stuck in transition with blocked worker threads visible via /proc/<pid>/stack holding cp_cm_lock.
Inbound RDMA-CM connection attempts from unexpected peers advertising legacy RDS protocol versions.

Detection Strategies

Monitor kernel logs for INFO: task ... blocked for more than 120 seconds messages tied to RDS workqueues.
Audit running kernel versions against the fixed commits across all distributions deploying RDS over InfiniBand.
Correlate RDMA-CM event floods with subsequent loss of RDS throughput on fabric-connected hosts.

Monitoring Recommendations

Alert on repeated RDS connection resets or workqueue stall telemetry forwarded to centralized logging.
Track InfiniBand subnet traffic for unauthorized endpoints initiating RDS connections.
Baseline normal RDS protocol negotiation and flag downgraded version offers to RDS_PROTOCOL values below the current compat version.

How to Mitigate CVE-2026-98257

Immediate Actions Required

Apply the upstream kernel patches referenced in the vendor advisories to all hosts running RDS-IB.
Restrict RDMA fabric access so only trusted peers can establish RDS connections to vulnerable hosts.
Unload the rds_rdma and rds kernel modules on systems that do not require RDS over InfiniBand.

Patch Information

The fix replaces the unsafe rds_conn_destroy() call in rds_ib_cm_connect_complete() with rds_conn_drop(), aligning the protocol-mismatch path with other RDMA-CM failure handlers. Patch commits are available at Kernel Git Commit 14fb900, Kernel Git Commit 344c72a, Kernel Git Commit 424019b, Kernel Git Commit 65ca0a5, Kernel Git Commit 7d8c22c, Kernel Git Commit b5c9f29, Kernel Git Commit d392b16, and Kernel Git Commit f97d8c7.

Workarounds

Blacklist the rds and rds_rdma modules on systems that do not use RDS over InfiniBand.
Enforce network-layer segmentation on the InfiniBand or RoCE fabric to limit which peers can reach RDS-enabled hosts.
Monitor for and administratively reset stalled RDS connections until kernel patches are deployed.

bash

# Prevent the vulnerable RDS modules from loading until patched
echo 'blacklist rds_rdma' | sudo tee /etc/modprobe.d/disable-rds.conf
echo 'blacklist rds'      | sudo tee -a /etc/modprobe.d/disable-rds.conf
sudo rmmod rds_rdma rds 2>/dev/null || true
sudo update-initramfs -u