Race condition in Linux kernel - CVE-2026-98352

Vulnerability details

The vulnerability allows a local user to cause a shared completion queue credit leak.

The vulnerability exists due to a race condition in the Linux kernel RDMA RTRS client when handling address resolution concurrently with connection teardown after an interrupted connection attempt. A local user can interrupt a connection attempt while the address resolution handler races with teardown to cause a shared completion queue credit leak.

Subsequent RDMA device unregistration triggers a kernel warning in ib_cq_pool_cleanup() if completion queue credits remain allocated.

Affected software

How to mitigate CVE-2026-98352

External References

• https://git.kernel.org/stable/c/2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda
• https://git.kernel.org/stable/c/31024e158b45358370a0a14ed96589e6aa62d6cb
• https://git.kernel.org/stable/c/6f8020fe7465f49e234a576c04e415e9d08c7878
• https://git.kernel.org/stable/c/74c4ed55e61f1b65ddbebc5b635d136461a1c3da
• https://git.kernel.org/stable/c/8f253d5893f991742464b9e7203c43fc08d0aa11
• https://git.kernel.org/stable/c/a82cca40139d9fcae8208901856bd5bb4051f097
• https://git.kernel.org/stable/c/bf88ac4867050112a6c819c8d1a7209bf48ef427

Related Security Bulletins

• Race condition in Linux kernel ulp rtrs driver
• Debian update for linux