Operation on a Resource after Expiration or Release in Linux kernel - CVE-2026-98359

Vulnerability details

The vulnerability allows a local user to cause an RDMA port query to operate on an unregistered and uninitialized network device.

The vulnerability exists due to a missing registration-state check in ib_get_eth_speed() when processing asynchronous RDMA port queries during network device unregistration. A local user can trigger an asynchronous RDMA port query to cause an RDMA port query to operate on an unregistered and uninitialized network device.

The reference returned by ib_device_get_netdev() keeps the network device structure allocated but does not ensure that the device remains operational. The ethtool callback can be invoked after NETDEV_UNREGISTER and ndo_uninit have completed.

Affected software

How to mitigate CVE-2026-98359

External References

• https://git.kernel.org/stable/c/45c60ffc79771bad154f224a05753191cf1b37bc
• https://git.kernel.org/stable/c/520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e
• https://git.kernel.org/stable/c/5bd42f74ec3b4f4687fb600f367af0828d513b3c
• https://git.kernel.org/stable/c/a219459fbd1b2598e63c81a52847eba6c28b72d2
• https://git.kernel.org/stable/c/be4b44c8b47c67a04c08b1a0aba18006b749ae6a
• https://git.kernel.org/stable/c/ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5

Related Security Bulletins

• Operation on a Resource after Expiration or Release in Linux kernel infiniband core driver
• Debian update for linux