Use-after-free in Linux kernel - CVE-2026-98360

Vulnerability details

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in the RDMA/rxe multicast-group handling code when a failed multicast-address operation frees a group that remains published in the multicast-group tree. A local user can request a subsequent attachment to the same multicast group to trigger a use-after-free in the kernel.

This path is reachable through ATTACH_MCAST on a UD queue pair. The initial rxe_mcast_add() failure can occur when the backing network device has been removed or dev_mc_add() returns an error.

Affected software

How to mitigate CVE-2026-98360

External References

• https://git.kernel.org/stable/c/02c0a2fa69c16248a7432af8a6d64ab2a73a5283
• https://git.kernel.org/stable/c/1caceeb2d74bbe88223aea55eb8626b4c5f076fd
• https://git.kernel.org/stable/c/c79a789aa15180a1543b5db49c343d12e3ec214d
• https://git.kernel.org/stable/c/d4fc4e37f8a143b0fe83b42c8fb48cf542154fee
• https://git.kernel.org/stable/c/ddb43ac0926d4a931bc9b7744b93627f627457e5
• https://git.kernel.org/stable/c/faae1fb4ccf8205806a8802c008798dabeb0205b

Related Security Bulletins

• Use-after-free in Linux kernel sw rxe driver
• Debian update for linux