CVE-2026-98253

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ucma: Serialize join and leave on copy_to_user failure

rdma_join_multicast() queues RoCE work that later reads the ucma_multicast

through event->param.ud.private_data, then list_add()s the CMA multicast

at the head of id_priv->mc_list. rdma_leave_multicast() matches only by

sockaddr and destroys the first hit.

ucma_process_join() used to drop ctx->mutex after a successful join and

retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls

with the same address can therefore insert a second CMA entry before the

first thread's leave. leave then cancels the newer work and the older

worker still dereferences the ucma_multicast that the first thread frees.

Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and,

on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join.

Do not leave if join itself failed: that path never published this address

on mc_list, and a leave

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References