CVE-2026-98360

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds

rxe_get_mcg() publishes a newly allocated multicast group in

rxe->mcg_tree before programming the backing Ethernet multicast address

with rxe_mcast_add(), which runs outside mcg_lock. A local userspace

RDMA client reaches this path with ATTACH_MCAST on a UD QP; if

rxe_mcast_add() then returns an error (for example -ENODEV when the

backing netdev has been removed, or a propagated dev_mc_add() error),

the unwind frees the published group without removing it from the tree.

A later lookup of the same MGID dereferences the freed struct rxe_mcg

from __rxe_lookup_mcg().

Fix this by keeping the new mcg private until rxe_mcast_add() succeeds.

Split the tree publication into __rxe_publish_mcg(), call rxe_mcast_add()

before taking the tree reference, and free the still-private mcg on

failure. Because the group is never visible in mcg_tree until the

multicas

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References