CVE-2026-98257

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rds: ib: use rds_conn_drop() on protocol version mismatch

rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with

conn->c_cm_lock held. When the peer negotiates a protocol version

older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls

rds_conn_destroy(), which is only safe in the rmmod path: it

synchronously tears the connection down and flush_work()es the

shutdown work cp_down_w.

That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is

the very lock the event handler still holds, so the flush never

completes: the two workers wait on each other and the RDS connection

workqueues stall for good.

All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,

DISCONNECTED) use rds_conn_drop(), which marks the connection

RDS_CONN_ERROR and schedules the shutdown work asynchronously. Use

it here as well.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References