CVE-2026-98253
7.8 HIGHPublished 2026-10-06 · Updated 2026-10-07
AI risk analysis
- Summary
- The Linux kernel's RDMA/ucma component has a race condition where concurrent multicast join operations can lead to improper cleanup of multicast entries, potentially causing use-after-free conditions and system instability. This occurs when one thread joins a multicast group while another leaves it, with the leave operation incorrectly freeing memory that the first thread still needs.
- Exploitability
- Exploitation is moderately difficult and requires concurrent access to the same multicast address from multiple threads, likely involving RDMA/UCMA operations in a multi-threaded environment with specific timing conditions.
- Blast radius
- The vulnerability could affect systems using RDMA over Converged Ethernet (RoCE) with multicast operations, potentially leading to kernel crashes, memory corruption, or denial of service conditions in high-performance computing environments.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Linux kernel version 6.10 or later which contains the fix for this race condition in RDMA/ucma multicast handling.
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copy_to_user failure rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s the CMA multicast at the head of id_priv->mc_list. rdma_leave_multicast() matches only by sockaddr and destroys the first hit. ucma_process_join() used to drop ctx->mutex after a successful join and retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucma_multicast that the first thread frees. Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and, on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mc_list, and a leave-by-addr would destroy an earlier successful join.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
All references
- https://git.kernel.org/stable/c/01cbdb724c584d7772fd25af2e4dfdf8527ce0d5
- https://git.kernel.org/stable/c/01e29d0d78a8f66f221625720a04939eef5ec1f6
- https://git.kernel.org/stable/c/29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9
- https://git.kernel.org/stable/c/43c4e24bd10370fc976f6220518049ce71419399
- https://git.kernel.org/stable/c/52172e11bd074ccaded21740ffeb67123f01dd00
- https://git.kernel.org/stable/c/662ade4de9ff5eceb0820a9f8e9fac70ba6a815b
- https://git.kernel.org/stable/c/83610ee5e498fa5bfcb80031d2b959baea276bf6
- https://git.kernel.org/stable/c/ae805d204cf1f15b87d1bf3529b4c649f3519420
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-100075
- HIGHCVE-2026-13087
- HIGHCVE-2026-64581
- HIGHCVE-2026-64582
- HIGHCVE-2026-89823
- HIGHCVE-2026-89836
- HIGHCVE-2026-89875
- HIGHCVE-2026-89893
Related by shared AI tags and CWE weakness class. Browse the full archive.