Linux Kernel CVE-2026-98070

Requires the RDS protocol module (AF_RDS over TCP) to be loaded and in use - a niche configuration typical of Oracle RAC/HPC/InfiniBand clusters. Exploitation is effectively limited to weakly ordered architectures (ARM, PowerPC); the store-buffering race cannot manifest on strongly ordered x86. The attacker must induce an RDS connection reset/reconnection (via the accept path in rds_tcp_reset_callbacks()) at the same time the local transmit path (rds_send_xmit) is active, hitting a narrow timing window - hence AC:H. No user interaction and no special privilege beyond opening/using an RDS socket are needed, but the combination of RDS deployment + weak-ordered CPU + concurrent-transmit timing sharply limits realistic exploitation.

This is a weakly-ordered-architecture concurrency race (CWE-362) in the Linux kernel's net/rds TCP transport, not the information-disclosure issue its tag suggests. The NVD CVSS of 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) is overstated: the C:H/I:H impact ratings are unjustified by the description, which describes rds_send_xmit() running concurrently with rds_send_path_reset() rewriting cp_xmit_* state plus use of a stale cached t_sock pointer - outcomes that are corruption/crash (denial of service), not attacker-controlled read/write of secret data or arbitrary integrity loss. AC:H is correct and important: the flaw is a store-buffering pattern that only manifests on weakly ordered CPUs (ARM/PowerPC, NOT x86) and requires the transmit path to be active concurrently with a connection reset, a narrow timing window. There is no EPSS score, no CISA KEV listing, and no public exploit - no exploitation signal corroborates the high CVSS. Net: this is a high-CVSS-but-low-real-risk item for most fleets, meaningful mainly to weakly-ordered-arch systems that actually load and use the RDS protocol. The AV:N metric is defensible because RDS is a network protocol and the vulnerable reset/accept path can be driven by a remote peer's reconnection, but full exploitation also depends on local transmit activity, so treating this as a purely remote unauthenticated primitive would overstate it - verify with the weak-memory-ordering caveat.

On an ARM or PowerPC host running the RDS TCP transport (e.g. an Oracle RAC / HPC node), an attacker who can repeatedly force RDS connection resets and reconnections while the local side is actively transmitting drives rds_tcp_reset_callbacks() to swap the socket and reset send state concurrently with rds_send_xmit(). Because the code only samples RDS_IN_XMIT clear rather than owning the lock, the two paths race and corrupt cp_xmit_* state or dereference a stale t_sock, crashing the kernel. No public exploit code exists and reliable triggering depends on the weak memory ordering of the CPU.