CVE-2026-98072

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: use wq_has_sleeper() in release_in_xmit()

release_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then

checks waitqueue_active() to decide whether anyone needs waking.

clear_bit_unlock() is only a release operation: it orders the

critical section before the bit clear, but does not order the

subsequent plain load of the wait queue head after it. The waiter

side does the mirror image - it adds itself to the wait queue and

then tests the bit. That is the classic store-buffering pattern: the

releasing CPU can read the wait queue as empty while the waiting CPU

still reads the bit as set, so the sleeper is never woken.

The waiters are rds_conn_shutdown() and rds_tcp_reset_callbacks(),

both in uninterruptible wait_event() with no timeout. A lost wake-up

strands the shutdown worker on its single-threaded workqueue until

some other sender releases the bit again - and on a connection that

is being torn do

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References