CVE-2026-98068

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: don't let rds_conn_shutdown() consume a concurrent drop

rds_conn_shutdown() finishes by moving the path from

RDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts

RDS_CONN_ERROR as the starting state of that final transition, so that

a FIN processed in softirq context during the teardown does not derail

the shutdown into a noisy error path.

But consuming that RDS_CONN_ERROR also consumes the shutdown pass that

came with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues

cp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN

is a no-op. For the FIN case that is harmless - the socket the FIN

arrived on is the very socket the teardown just released. It is not

harmless for a dropper that attached something to the path first.

rds_tcp_accept_one() is such a dropper. Its path claim in

rds_tcp_accept_one_path() transitions RDS_CONN_DOWN ->

RDS_CONN_CONNECTING, and a concurrent drop -

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References