SB20260928121 - Race condition in Linux kernel rds

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-98072)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory ordering in release_in_xmit() in the RDS networking component when concurrently releasing transmit state and checking for waiters. A local user can trigger a race between waiter registration and transmit-state release to cause a denial of service.

A lost wake-up can leave shutdown workers waiting indefinitely in uninterruptible wait operations.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3764627b30a283e611e652c4a2bb8cdc74a75a99
• https://git.kernel.org/stable/c/6d0c8b7073913011459cf968cbbadd341e166bc3
• https://git.kernel.org/stable/c/a269795107f45adc95975a83324f8fef40bec4ce
• https://git.kernel.org/stable/c/ed7ee0cd0e136d02f87f13181b1a89880463c7e9