EUVD-2026-93185
GHSA-36mq-8633-f579
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach target RDS/RDMA-CM endpoint
-
ExploitNegotiate pre-COMPAT protocol version
-
ExecutionHandler calls rds_conn_destroy under c_cm_lock
-
ImpactRDS workqueues deadlock and stall permanently
Vulnerability Assessment
| Exploitation Conditions | Requires the target host to have the RDS protocol stack loaded and bound over an RDMA transport (Infiniband/RoCE/iWARP) with an RDMA-CM listener reachable by the attacker. The specific trigger is a peer negotiating a protocol version OLDER than RDS_PROTOCOL_COMPAT_VERSION during rds_ib_cm_connect_complete(). LIMITING FACTORS: hosts without RDS-over-RDMA configured are entirely unaffected; the attacker must be able to establish an RDMA-CM connection to the target, which typically means presence on the same RDMA fabric/subnet rather than arbitrary remote internet access; no user interaction and no authentication are needed once connectivity exists (PR:N/UI:N). |
| Impact | This is a kernel denial-of-service, not an information-disclosure or code-execution flaw: the provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is explicitly C:N/I:N/A:H, meaning the only impact is availability. The mechanism is a self-deadlock in the RDS Infiniband path: rds_ib_cm_connect_complete() calls rds_conn_destroy() (rmmod-only, synchronous) while holding c_cm_lock, so the shutdown work that also needs that lock can never complete and the RDS workqueues stall permanently. Real-world risk is LOW-to-MODERATE despite the 7.5: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing and no public exploit identified, and the vulnerable code path only exists where RDS-over-RDMA (Infiniband/RoCE/iWARP) is actually configured and reachable - a niche subsystem. The NVD vector states AV:N, but exploitation requires the attacker to act as an RDS peer negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION over an RDMA-CM connection, which in most deployments means adjacency to the RDMA fabric rather than arbitrary internet reachability - verify the exposure of your RDMA fabric. CONFLICTING SIGNAL: the input Tags label this 'Information Disclosure', which directly contradicts the C:N/I:N/A:H vector - this is a hang/DoS, not disclosure. |
| Exploit ScenarioDerived | An attacker able to initiate an RDS connection to a target over an RDMA fabric opens an RDMA-CM session and negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. This drives the connect-complete handler into the synchronous rds_conn_destroy() path while c_cm_lock is held, deadlocking the shutdown worker against itself and permanently stalling the host's RDS workqueues. No public exploit is identified at time of analysis, and no authentication is required per the CVSS vector (PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
A protocol-version negotiation mismatch during RDS-over-RDMA connection setup in the Linux kernel deadlocks the kernel by making an RDMA-CM event handler wait on itself, permanently stalling the RDS connection workqueues and causing denial of service. Only hosts with the RDS stack loaded and bound to an RDMA transport (InfiniBand, RoCE, or iWARP) that expose a reachable RDMA-CM listener are affected; unauthenticated peers able to establish an RDMA-CM connection - typically from the same RDMA fabric or subnet (assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - can trigger it by negotiating a protocol version older than RDS_PROTOCOL_COMPAT_VERSION. Impact is availability-only (C:N/I:N/A:H); EPSS is low at 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected stable branches.
RemediationAI
Vendor-released patch: apply the stable kernel updates containing the fix - 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, or 7.2.8 (or the 7.3-rc4 development branch) - or cherry-pick the relevant per-branch commit (for example 424019be3f637da76b74f44a40034669acbb166f and its siblings at git.kernel.org); the change swaps rds_conn_destroy() for the asynchronous rds_conn_drop() in the version-mismatch path of rds_ib_cm_connect_complete(), which is a minimal and low-risk behavior alignment with the existing REJECTED/CONNECT_ERROR/DISCONNECTED handling. Where patching cannot be applied immediately, the most effective compensating control is to eliminate the attack surface entirely by not loading the RDS-over-RDMA stack: unload the rds_ib (and, if unused, rds) module with modprobe -r or blacklist it, or build kernels without CONFIG_RDS_RDMA - the trade-off is loss of any RDS-over-RDMA workload on that host, though plain RDS and everything unrelated to RDS continue to function. Because the trigger requires a peer that can complete an RDMA-CM connection, restrict the RDMA fabric and its CM/RDS ports to trusted hosts at the switch, partition, or fabric ACL level, or isolate the RDMA subnet from untrusted participants; this does not fix the deadlock but removes the reachable path, and it depends on fabric-level policy being reliably enforced. Note that ordinary IP firewalls do not gate RDMA-CM traffic, so port-based filtering alone is generally insufficient on RoCE/iWARP deployments. The NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98257 and EUVD-2026-93185 can be tracked for distro-specific advisory updates, and given the low EPSS (0.18%, 7th percentile) and the absence of identified public exploit code, prioritize patching by exposure: internet- or cross-tenant-reachable RDMA fabrics first, isolated clusters later.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
RDS (Reliable Datagram Sockets) is a Linux kernel transport, and the rds_ib module implements it over InfiniBand/RDMA using the RDMA Connection Manager (RDMA-CM). When an inbound connection completes, the CM event handler rds_ib_cm_connect_complete() runs while holding the connection's c_cm_lock and compares the peer's advertised protocol version against RDS_PROTOCOL_COMPAT_VERSION. On a mismatch the vulnerable code called rds_conn_destroy(), a teardown primitive intended only for the module-removal path: it synchronously flushes the shutdown work item cp_down_w, which in turn requires cp_cm_lock - a lock still held by the very event handler performing the flush. The result is a circular wait (deadlock class, consistent with improper-locking/CWE-667 and deadlock/CWE-833 patterns) in which the two kernel workers never complete and the RDS connection workqueues stall indefinitely. Every other RDMA-CM failure path (REJECTED, CONNECT_ERROR, DISCONNECTED) already uses the correct asynchronous primitive rds_conn_drop(), which marks the connection RDS_CONN_ERROR and schedules shutdown work rather than waiting for it; the fix aligns the version-mismatch path with that behavior, preserving the intended rejection semantics without the blocking flush. Note that the supplied tag metadata labels this as Information Disclosure, which is inconsistent with both the description and the assessed vector - the demonstrated effect is availability loss, not data exposure.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Trigger requires initiating an RDMA-CM peer connection over an RDMA fabric, so AV:A not AV:N; protocol negotiation is trivial (AC:L), unauthenticated (PR:N), and impact is a permanent hang (A:H only).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
rds: ib: use rds_conn_drop() on protocol version mismatch
rds_ib_cm_connect_complete() runs from the RDMA-CM event handler with conn->c_cm_lock held. When the peer negotiates a protocol version older than RDS_PROTOCOL_COMPAT_VERSION, the handler calls rds_conn_destroy(), which is only safe in the rmmod path: it synchronously tears the connection down and flush_work()es the shutdown work cp_down_w.
That shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is the very lock the event handler still holds, so the flush never completes: the two workers wait on each other and the RDS connection workqueues stall for good.
All other RDMA-CM failure paths (REJECTED, CONNECT_ERROR, DISCONNECTED) use rds_conn_drop(), which marks the connection RDS_CONN_ERROR and schedules the shutdown work asynchronously. Use it here as well.
Executive ViewAI
Linux hosts that run the RDS stack over RDMA transports such as InfiniBand, RoCE, or iWARP face an availability-only denial-of-service risk where an unauthenticated peer on the same RDMA fabric or subnet can trigger a kernel deadlock and stall RDS connection workqueues. Leadership should care because affected HPC, storage, or database workloads can become unresponsive or require restart, although vendor patches are available and no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB