Linux Kernel CVE-2026-98359

Requires: (1) a host with an active RDMA device whose link layer is Ethernet (RoCE) or InfiniBand so that ib_get_eth_speed()/ib_device_get_netdev() is exercised; (2) a net_device that is in the process of unregistering (NETDEV_UNREGISTER and ndo_uninit completed) while its reference is still held; and (3) an asynchronous RDMA port query that races into the stale device's ethtool callback. Limiting factors per CVSS: local access only (AV:L), low privileges needed (PR:L), no user interaction, and HIGH attack complexity (AC:H) because success depends on winning a narrow timing window during device teardown - hosts without RDMA/InfiniBand/RoCE hardware or configuration are not exposed at all.

This is a race condition in the Linux kernel's RDMA/core subsystem (ib_get_eth_speed) where an asynchronous RDMA port query can invoke a net_device's ethtool callback after NETDEV_UNREGISTER/ndo_uninit have completed, i.e. a use-after-registration/use-after-free class defect. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H, score 7.0) is internally consistent: it correctly models LOCAL access, LOW privileges, and notably HIGH attack complexity, which captures the narrow race window between the port query and device teardown - this flaw is not trivially triggerable on demand. The real-world risk signals all point the same direction and are low: EPSS is 0.17% (5th percentile), there is no CISA KEV listing, and no public POC is indicated. No SSVC decision data was provided. The high C/I/A impact reflects generic kernel memory-corruption scoring rather than a demonstrated exploit, and the AC:H race requirement plus local PR:L requirement make reliable weaponization difficult. Note a labeling tension: the input Tags mark this 'Information Disclosure,' but the description describes a use-after-free/stale-pointer race on an unregistering netdev, whose most likely practical outcome is a kernel crash (DoS) rather than data leakage - treat the information-disclosure framing with caution. Overall this is a legitimate correctness/stability fix worth patching through normal stable-kernel update cycles, but it is NOT an emergency: high CVSS is driven by worst-case kernel impact assumptions, while every exploitation-probability signal (EPSS, KEV, POC) indicates low real-world urgency.

A local, low-privileged user on a host with an active RDMA/InfiniBand or RoCE device triggers an asynchronous RDMA port speed query at the exact moment the associated network device is being unregistered (e.g. during interface teardown or driver removal). If the attacker wins the narrow race, ib_get_eth_speed() calls the ethtool callback of a device that has already passed NETDEV_UNREGISTER/ndo_uninit, dereferencing stale state and likely crashing the kernel or corrupting memory. No public exploit identified at time of analysis, and the high attack complexity (race window) makes reliable triggering difficult.