Use-after-free in Linux kernel - CVE-2026-98253

Vulnerability details

The vulnerability allows a local user to trigger a use-after-free in the kernel.

The vulnerability exists due to a use-after-free in ucma_process_join() in the RDMA/ucma subsystem when handling concurrent multicast joins and a copy_to_user() failure. A local user can issue concurrent JOIN_MCAST calls for the same address and trigger a response-copy failure to trigger a use-after-free in the kernel.

Multicast leave operations match entries by socket address and destroy the first matching entry. This can cancel the newer RoCE work while an older worker still references the freed ucma_multicast object.

Affected software

How to mitigate CVE-2026-98253

External References

• https://git.kernel.org/stable/c/01cbdb724c584d7772fd25af2e4dfdf8527ce0d5
• https://git.kernel.org/stable/c/01e29d0d78a8f66f221625720a04939eef5ec1f6
• https://git.kernel.org/stable/c/29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9
• https://git.kernel.org/stable/c/43c4e24bd10370fc976f6220518049ce71419399
• https://git.kernel.org/stable/c/52172e11bd074ccaded21740ffeb67123f01dd00
• https://git.kernel.org/stable/c/662ade4de9ff5eceb0820a9f8e9fac70ba6a815b
• https://git.kernel.org/stable/c/83610ee5e498fa5bfcb80031d2b959baea276bf6
• https://git.kernel.org/stable/c/ae805d204cf1f15b87d1bf3529b4c649f3519420

Related Security Bulletins

• Use-after-free in Linux kernel infiniband core driver
• Debian update for linux