CVE-2026-98560

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: size a connection's path set by the transport it ends up with

__rds_conn_create() computes npaths from the caller's transport before

it decides whether a connection to one of the host's own addresses is

to be handled by the loopback transport instead. That substitution is

what an RDS/TCP socket sending to a local address gets, and after it

the path init loop still runs for the TCP transport's RDS_MPATH_WORKERS

paths and allocates an ordered workqueue for each, while

rds_loop_conn_alloc() only ever provides transport data for path 0.

rds_conn_destroy() sizes its teardown from c_trans, by then the

loopback transport, so it visits path 0 only - and

rds_conn_path_destroy() would skip the other paths anyway, since it

returns before destroy_workqueue() for a path without transport data.

kfree(c_path) then drops the last pointers to seven workqueues. That

repeats for every such connection, on every netns teardow

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References