CVE-2026-45898

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/iwcm: Fix workqueue list corruption by removing work_list

The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()")

changed the work submission logic to unconditionally call

queue_work() with the expectation that queue_work() would

have no effect if work was already pending. The problem is

that a free list of struct iwcm_work is used (for which

struct work_struct is embedded), so each call to queue_work()

is basically unique and therefore does indeed queue the work.

This causes a problem in the work handler which walks the work_list

until it's empty to process entries. This means that a single

run of the work handler could process item N+1 and release it

back to the free list while the actual workqueue entry is still

queued. It could then get reused (INIT_WORK...) and lead to

list corruption in the workqueue logic.

Fix this by just removing the work_list. The workqueue already

does this for us.

This fixes

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References