CVE-2026-90081

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: use wq_has_sleeper() in rds_cong_map_updated()

rds_cong_map_updated() runs after a peer's congestion map has been

rewritten (by rds_tcp_cong_recv() and rds_ib_cong_recv(), or the

clear-all in the loopback and IB send-completion paths). It bumps

rds_cong_generation and then checks waitqueue_active() on

map->m_waitq and on rds_poll_waitq to decide whether anyone needs

waking. atomic_inc() carries no ordering and waitqueue_active() is a

plain load, so nothing orders the map and generation stores before

the wait queue reads. The waiters do the mirror image: rds_cong_wait()

adds itself to m_waitq and then tests the port bit, and rds_poll()

registers on rds_poll_waitq and then reads the generation. That is

the store-buffering pattern described above waitqueue_active() in

include/linux/wait.h - the updater can observe an empty wait queue

while the waiter still observes the port as congested, and no wake-up

is i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References