SB20261007116 - Use-after-free in Linux kernel infiniband core driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261007116

SB20261007116 - Use-after-free in Linux kernel infiniband core driver

Published: October 7, 2026

Security Bulletin ID SB20261007116
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use-after-free (CVE-ID: CVE-2026-98253)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in ucma_process_join() in the RDMA/ucma subsystem when handling concurrent multicast joins and a copy_to_user() failure. A local user can issue concurrent JOIN_MCAST calls for the same address and trigger a response-copy failure to trigger a use-after-free in the kernel.

Multicast leave operations match entries by socket address and destroy the first matching entry. This can cancel the newer RoCE work while an older worker still references the freed ucma_multicast object.


Remediation

Install update from vendor's website.

References