CVE-2026-98069

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: acquire the fastpath locks in rds_conn_shutdown()

rds_conn_shutdown() quiesces the transmit and receive-refill paths by

waiting for RDS_IN_XMIT and RDS_RECV_REFILL to be sampled clear, and

then runs the transport shutdown and rds_conn_path_reset(). Sampling

the bits clear is not the same as owning them: the moment after the

wait_event() returns, rds_send_xmit() can re-acquire RDS_IN_XMIT (or

rds_ib_recv_refill() can re-acquire RDS_RECV_REFILL) and run

concurrently with the teardown.

The sender does recheck the connection state after taking the lock,

but that recheck is a classic store-buffering pattern: teardown writes

the state and reads the bit while the sender writes the bit and reads

the state. acquire_in_xmit() is only an acquire operation, so on

weakly ordered architectures both sides can miss each other's write,

and the transmit path then runs while the transport zeroes its rings

(e.g. rds_ib_ring_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References