Cloudanix VulnDB

CVE-2026-98359

High · 7.0

CVSS

7.0

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing flaw in the Linux kernel's high-speed networking code can let an attacker on the same machine crash the system or corrupt memory.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in RDMA/core allows ib_get_eth_speed to invoke ethtool callbacks on a net_device after NETDEV_UNREGISTER and ndo_uninit have completed, because registration state is not verified while holding RTNL.

Why it matters to the business

RDMA-enabled Linux systems risk kernel instability, crashes, or memory corruption that can disrupt high-performance networking workloads and require unplanned reboots.

How an attack unfolds

A local attacker triggers concurrent RDMA port queries while a netdev is unregistering; the missing NETREG_REGISTERED check under RTNL lets the ethtool call proceed on a device that is no longer operational.

How to fix it

Apply the upstream fix that adds an explicit NETREG_REGISTERED check under RTNL before the ethtool call and drops the netdev reference only after all accesses complete.

How to confirm the fix worked

Confirm the registration-state guard and RTNL-protected ethtool path exist in ib_get_eth_speed; test by attempting netdev unregistration concurrent with RDMA queries and verify -ENODEV is returned instead of a crash.

Typical attack path

  1. Obtain local access on an RDMA-capable Linux host
  2. Initiate netdev unregistration (for example via interface down or module unload)
  3. Simultaneously perform asynchronous RDMA port speed queries
  4. Trigger use-after-unregister in ib_get_eth_speed

How to detect it

Review kernel logs and crash dumps for oops or warnings referencing ib_get_eth_speed, netdev unregistration, or ethtool callbacks during RDMA operations.

What your security team should do

  • Expedite kernel updates on all RDMA/Ethernet systems within the next maintenance window
  • Temporarily restrict unprivileged local accounts on exposed hosts until patched
  • Enable kernel crash-dump collection and monitor for netdev-related oops

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed ib_device_get_netdev() intentionally returns a referenced net_device even when it is unregistering, so matching and cleanup callers can still find the association. The reference keeps struct net_device allocated, but does not guarantee that the device remains operational. ib_get_eth_speed() uses the returned device operationally by invoking its ethtool callback. Although that call is made under RTNL, the function does not verify the registration state first. An asynchronous RDMA port query can therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit have completed. Check for NETREG_REGISTERED while holding RTNL and return -ENODEV for a device which is being unregistered. Keeping RTNL across the check and the ethtool operation prevents unregister from starting between them. Keep the speed fallback and warning under RTNL as well, so the warning can safely read netdev->name. Drop the netdev reference before releasing RTNL once all accesses to the device are complete.

Affected packages

Ecosystem Package Introduced Fixed