Look up another CVE · open CVE-2026-98253 in the interactive tracker
CVE-2026-98253
RDMA/ucma: Serialize join and leave on copy_to_user failure
Published 2026-10-06 (13 days ago) by the Linux kernel CNA. Subsystem drivers/infiniband. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-98253 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6568-1 · 2026-10-16 · text | 6.12.113-1 | Update the kernel and reboot. DSA-6568-1 shipped the fix on 2026-10-16, in 6.12.113-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s the CMA multicast at the head of id_priv->mc_list. rdma_leave_multicast() matches only by sockaddr and destroys the first hit. ucma_process_join() used to drop ctx->mutex after a successful join and retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucma_multicast that the first thread frees. Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and, on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mc_list, and a leave-by-addr would destroy an earlier successful join.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/infiniband/core/ucma.c
- What this is
- INFINIBAND SUBSYSTEMMAINTAINERS section matched on drivers/infiniband/ · linux-rdma@vger.kernel.org · Supported
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-10-06 (13 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- drivers/infiniband
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10.20 | 5.10.271 | 29b9ed83d8bf |
| 5.12 | 5.15.222 | 52172e11bd07 |
| 5.12 | 6.1.189 | 01e29d0d78a8 |
| 5.12 | 6.6.158 | ae805d204cf1 |
| 5.12 | 6.12.112 | 43c4e24bd103 |
| 5.12 | 6.18.54 | 01cbdb724c58 |
| 5.12 | 7.2.8 | 83610ee5e498 |
| 5.12 | 7.3 | 662ade4de9ff |
| 5.11.3 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DSA-6568-1 | 2026-10-16 | trixie 6.12.113-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached by write() of RDMA_USER_CM_CMD_JOIN_MCAST/JOIN_IP_MCAST on the local char device /dev/infiniband/rdma_cm into ucma_process_join(). The trigger is local: two racing joins and a bad response pointer. No remote peer supplies the data that causes it, so AV:L.
- AC:LAttack complexity, low
- The attacker drives every part of the race. They make copy_to_user() fail with a bad cmd->response pointer, and a second thread issues JOIN_MCAST for the same address while ctx->mutex is dropped. rdma_leave_multicast() then destroys the newer mc_list head and cancels the wrong iboe_join work. The attempt can be repeated until it wins.
- PR:LPrivileges required, low
- rdma_cm is created with mode 0666 and ucma_write() does no capability check. Any local user on a host with a RoCE port can create a UD cm_id, bind it and join multicast. An unprivileged user cannot create a soft-RoCE device, because nldev NEWLINK needs CAP_NET_ADMIN in the initial namespace, so the RoCE port must already exist.
- UI:NUser interaction, none
- The attacker triggers the bug entirely through their own writes on an rdma_cm file descriptor they opened. No other user or administrator has to act.
- S:UScope, unchanged
- The freed ucma_multicast and the corrupted kernel heap are in the same kernel security authority. This is local kernel memory corruption, not a VM or IOMMU boundary crossing.
- C:HConfidentiality impact, high
- cma_iboe_join_work_handler() calls ucma_create_uevent() on the freed ucma_multicast, reading mc->uid and mc->id into the event that GET_EVENT copies to userspace. If the freed slot is reclaimed with sprayed objects, this use-after-free gives a read primitive.
- I:HIntegrity impact, high
- uevent->mc keeps a pointer to the freed ucma_multicast, and ucma_get_event() then runs uevent->mc->events_reported++. That is an attacker-timed write into freed and reclaimable slab memory, usable to corrupt an object sprayed into the slot.
- A:HAvailability impact, high
- The use-after-free of ucma_multicast in the RoCE join worker and in ucma_get_event() can corrupt the slab or oops the kernel, crashing the host. Syzbot reported this bug (extid a6ffe86390c8a6afc818).