CVE-2026-98070

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

rds_tcp_reset_callbacks() quiesces the transmit path by setting the

path state to RDS_CONN_RESETTING and then waiting for RDS_IN_XMIT to

be sampled clear before swapping the underlying socket and calling

rds_send_path_reset().

Sampling the bit clear is not the same as owning it: rds_send_xmit()

can re-acquire RDS_IN_XMIT right after the wait_event() returns. Its

state recheck after taking the lock is a store-buffering pattern (the

resetter writes the state and reads the bit, the sender writes the

bit and reads the state) and acquire_in_xmit() is only an acquire

operation, so on weakly ordered architectures both sides can miss

each other's write and the transmit path then runs concurrently with

rds_send_path_reset() rewriting cp_xmit_* state - which is exactly

what the comment above rds_send_path_reset() tells its callers to

prevent.

Take the lock instead, h

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References