Cloudanix VulnDB

CVE-2026-98253

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing flaw in the Linux kernel's network multicast code can let a logged-in user crash the whole machine or potentially take control of it.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in RDMA/ucma multicast join/leave handling: concurrent JOIN_MCAST calls with identical addresses allow a second entry to be inserted on mc_list before the first thread completes copy_to_user, so a subsequent leave cancels the wrong work item and leaves a dangling ucma_multicast pointer that an older worker later dereferences.

Why it matters to the business

Local users on Linux systems using RDMA can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation; high-value RDMA fabrics in HPC, storage, and cloud environments face elevated operational risk until patched.

How an attack unfolds

An attacker with local access spawns multiple threads that issue identical RDMA join-multicast requests; the window created by dropping the context mutex around copy_to_user allows the second join to publish before the first can clean up on failure, after which a leave-by-address destroys the wrong entry and the surviving worker dereferences freed memory.

How to fix it

Upgrade the Linux kernel to a version that keeps ctx->mutex held across the entire rdma_join_multicast to copy_to_user sequence and only calls leave on successful publish paths; apply the fix referenced in the upstream commit that serializes join and leave on copy_to_user failure.

How to confirm the fix worked

Confirm the running kernel contains the mutex-hold-through-copy_to_user change; exercise concurrent JOIN/LEAVE paths under memory-pressure conditions and verify no use-after-free warnings appear in dmesg or kmemleak; re-test with the original reproducer to ensure list integrity is preserved.

Typical attack path

  1. Obtain local shell on target Linux host with RDMA stack loaded
  2. Open multiple RDMA CM file descriptors and issue concurrent JOIN_MCAST ioctls using the same multicast address
  3. Force one or more copy_to_user calls to fail (e.g., via memory pressure or crafted user buffers)
  4. Trigger rdma_leave_multicast (directly or via process exit) to cancel the wrong work item
  5. Wait for the older worker to dereference the freed ucma_multicast object

How to detect it

Review kernel logs for RDMA/ucma use-after-free or list corruption warnings around the time of any local RDMA activity; correlate process creation of multiple threads performing RDMA CM ioctls with subsequent kernel oops or reboot events.

What your security team should do

  • Prioritize kernel updates on any system exposing RDMA interfaces to untrusted local users
  • Restrict RDMA device access via cgroups or permissions until patches are deployed
  • Monitor for kernel oops or slab corruption on RDMA hosts and escalate any observed crashes for forensic review
  • Re-evaluate EPSS and exploit maturity 30 days after patch availability

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copy_to_user failure rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s the CMA multicast at the head of id_priv->mc_list. rdma_leave_multicast() matches only by sockaddr and destroys the first hit. ucma_process_join() used to drop ctx->mutex after a successful join and retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucma_multicast that the first thread frees. Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and, on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mc_list, and a leave-by-addr would destroy an earlier successful join.

Affected packages

Ecosystem Package Introduced Fixed