{"metadata": {"vulnerability": "CVE-2026-98431", "count": 20, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-25T10:25:14.348Z", "date_only": false, "value": "2026-09-25T10:25:14.348Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98431", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98431", "record": "UBUNTU-CVE-2026-98431", "field": "published"}, {"timestamp": "2026-10-14T13:27:56.162Z", "date_only": false, "value": "2026-10-14T13:27:56.162Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98431", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:54Z", "date_only": false, "value": "2026-10-14T14:17:54Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CHHW-GJHV-85V8", "record": "GHSA-CHHW-GJHV-85V8", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T14:17:54.887Z", "date_only": false, "value": "2026-10-14T14:17:54.887", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98431", "record": "FKIE_CVE-2026-98431", "field": "published"}, {"timestamp": "2026-10-14T15:32:21Z", "date_only": false, "value": "2026-10-14T15:32:21Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CHHW-GJHV-85V8", "record": "GHSA-CHHW-GJHV-85V8", "field": "published"}, {"timestamp": "2026-10-14T15:32:21Z", "date_only": false, "value": "2026-10-14T15:32:21Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CHHW-GJHV-85V8", "record": "GHSA-CHHW-GJHV-85V8", "field": "modified"}, {"timestamp": "2026-10-14T18:53:01.802Z", "date_only": false, "value": "2026-10-14T18:53:01.802266Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440772919819727", "record": "CVE-2026-98431", "field": "creation_timestamp", "uuid": "d2d105c5-b081-4874-b90a-0d4aa72f8601", "content": "CVE-2026-98431 RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency In the Linux kernel, the following vulnerability has been resolved:\nRDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency\nCommit 51976c6cd786 (\"RDMA/core: Provide rdma_user_mmap_disassociate()to disassociate mmap pages\") introduced disassociation_lock to protectnew mmap registrations against uverbs_user_mmap_disassociate(), butcreated an ABBA deadlock:\n  Thread A (mmap / fork):    mmap_lock -> disassociation_lock\n  Thread B (disassociate):    disassociation_lock -> mmap_lock\nFix by removing disassociation_lock entirely and using the pre-existinghw_destroy_rwsem instead. hw_destroy_rwsem already provides the sameprotection: rdma_umap_open() and ib_uverbs_mmap() both usedown_read_trylock() before registering a new VMA, so holding hw_destroy_rwsemin uverbs_user_mmap_disassociate() is sufficient to block new registrations.trylock is used in both mmap paths (not blocking down_read) becausemmap_lock is already held on entry, and uverbs_user_mmap_disassociate()acquires mmap_lock internally \u2014 a blocking read would recreate the samedeadlock.\nThe only caller that was not taking hw_destroy_rwsem for write wasrdma_user_mmap_disassociate(). Fix it to take the rwsem per-ufile whileiterating under lists_mutex.  This is safe because ib_uverbs_close()releases hw_destroy_rwsem entirely before acquiring lists_mutex, so thetwo locks are never held simultaneously.\nlockdep warning:\n [  776.654252] ====================================================== [  776.655214] WARNING: possible circular locking dependency detected [  776.656167] 6.18.0for-upstream_debug_94e244d9ccab #1 Not tainted [  776.657114] ------------------------------------------------------ [  776.658087] devlink/14824 is trying to acquire lock: [  776.658879] ffff88811170c800 (&mm->mmap_lock){++++}-{4:4}, at: uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs] [  776.660479] [  776.660479] but task is already holding lock: [  776.661460] ffff888142d92b08 (&file->disassociation_lock){+.+.}-{4:4}, at: uverbs_user_mmap_disassociate+0x39/0x780 [ib_uverbs] [  776.663177] [  776.663177] which lock already depends on the new lock. [  776.663177] [  776.664525] [  776.664525] the existing dependency chain (in reverse order) is: [  776.665724] [  776.665724] -> #2 (&file->disassociation_lock){+.+.}-{4:4}: [  776.666887]        __mutex_lock+0x16d/0x2330 [  776.667633]        rdma_umap_open+0x129/0x280 [ib_uverbs] [  776.668489]        dup_mmap+0xa40/0x1790 [  776.669170]        copy_process+0x5dd2/0x6170 [  776.669933]        kernel_clone+0xb6/0x610 [  776.670636]        __do_sys_clone+0xb5/0xf0 [  776.671354]        do_syscall_64+0x70/0x12e0 [  776.672083]        entry_SYSCALL_64_after_hwframe+0x4b/0x53 [  776.672940] [  776.672940] -> #1 (&mm->mmap_lock/1){+.+.}-{4:4}: [  776.673985]        down_write_nested+0x90/0x1e0 [  776.674751]        dup_mmap+0x201/0x1790 [  776.675448]        copy_process+0x5dd2/0x6170 [  776.676180]        kernel_clone+0xb6/0x610 [  776.676904]        __do_sys_clone+0xb5/0xf0 [  776.677615]        do_syscall_64+0x70/0x12e0 [  776.678351]        entry_SYSCALL_64_after_hwframe+0x4b/0x53 [  776.679239] [  776.679239] -> #0 (&mm->mmap_lock){++++}-{4:4}: [  776.680253]        __lock_acquire+0x18c6/0x2ec0 [  776.681018]        lock_acquire+0x10e/0x2e0 [  776.681742]        down_read+0x95/0x430 [  776.682395]        uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs] [  776.683436]        uverbs_destroy_ufile_hw+0x1ae/0x270 [ib_uverbs] [  776.684416]        ib_uverbs_remove_one+0x22b/0x420 [ib_uverbs] [  776.685371]        remove_client_context+0xa6/0xf0 [ib_core] [  776.686342]        disable_device+0x12b/0x240 [ib_core] [  776.687249]        __ib_unregister_device+0x269/0x460 [ib_core] [  776.688233]        ib_unregister_device+0x21/0x30 [ib_core] [  776.689140]        mlx5r_remove+0xd0/0x170 [mlx5_ib] [  776.689999]        device_release_driver_internal+0x3b2/0x5---truncated---\nhttps://www.cve.org/CVERecord?id=CVE-2026-98431https://git.kernel.org/stable/c/426f54f20b79c5b164a0472ad3f6ba36afcd08c6https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236#kernel #Linux#CVE_2026_98431#bot", "url": "https://infosec.exchange/users/cve/statuses/117440772919819727"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": false, "value": "2026-10-17T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-17T06:05:41.275Z", "date_only": false, "value": "2026-10-17T06:05:41.275794Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98431", "record": "BELL-CVE-2026-98431", "field": "published"}, {"timestamp": "2026-10-17T06:20:30.335Z", "date_only": false, "value": "2026-10-17T06:20:30.335482Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98431", "record": "BELL-CVE-2026-98431", "field": "modified"}, {"timestamp": "2026-10-18T10:27:42Z", "date_only": false, "value": "2026-10-18T10:27:42Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-18T10:27:42Z", "date_only": false, "value": "2026-10-18T10:27:42Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12165-1", "record": "OPENSUSE-SU-2026:12165-1", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-19T08:09:24Z", "date_only": false, "value": "2026-10-19T08:09:24Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98431", "record": "UBUNTU-CVE-2026-98431", "field": "modified"}, {"timestamp": "2026-10-19T09:19:26.316Z", "date_only": false, "value": "2026-10-19T09:19:26.316Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98431", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T09:19:26.316Z", "date_only": false, "value": "2026-10-19T09:19:26.316Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98431", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T10:18:49.857Z", "date_only": false, "value": "2026-10-19T10:18:49.857", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98431", "record": "FKIE_CVE-2026-98431", "field": "lastModified"}]}