FKIE_CVE-2026-98068

Vulnerability from fkie_nvd - Published: 2026-09-25 11:17 - Updated: 2026-09-25 11:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rds_conn_shutdown() consume a concurrent drop rds_conn_shutdown() finishes by moving the path from RDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts RDS_CONN_ERROR as the starting state of that final transition, so that a FIN processed in softirq context during the teardown does not derail the shutdown into a noisy error path. But consuming that RDS_CONN_ERROR also consumes the shutdown pass that came with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues cp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN is a no-op. For the FIN case that is harmless - the socket the FIN arrived on is the very socket the teardown just released. It is not harmless for a dropper that attached something to the path first. rds_tcp_accept_one() is such a dropper. Its path claim in rds_tcp_accept_one_path() transitions RDS_CONN_DOWN -> RDS_CONN_CONNECTING, and a concurrent drop - a FIN on a previous socket in softirq context, an administrative reset - can put the path into RDS_CONN_ERROR between that claim and the state check that follows, which accepts RDS_CONN_ERROR. The accept then installs the freshly accepted socket with rds_tcp_set_callbacks() while the queued teardown - which sampled tc->t_sock before this socket existed - is still running. rds_connect_path_complete() fails its transition to RDS_CONN_UP and drops the path again, queueing the pass that should reap the socket it just installed. If the in-flight shutdown's final transition consumes that drop's RDS_CONN_ERROR, the queued pass finds the path in RDS_CONN_DOWN and does nothing. The installed socket is never torn down: it sits established with its callbacks armed and its rds_tcp_connection on rds_tcp_tc_list, the peer sees a connection that nothing ever reads, and the path is wedged in RDS_CONN_DOWN until some later event drops it again. Reproduced with widened race windows as an ever-growing receive queue on a socket owned by a path stuck in RDS_CONN_DOWN, with the peer's send path wedged behind it. Make the final transition only DISCONNECTING -> DOWN. If it fails because the path is in RDS_CONN_ERROR, a drop raced the teardown: cancel the reconnect timer and clear RDS_RECONNECT_PENDING - the one piece of the skipped tail that must not be left behind - and return, letting the pass the drop queued finish the job: it tears down whatever attached to the path in the meantime, completes the transition to RDS_CONN_DOWN, and re-arms the reconnect from its own tail. The timer quiesce in that branch matters because the racing drop does not always queue that pass: rds_conn_path_drop() returns without queueing when a destroy is pending - exactly the situation during a netns teardown or module unload, when a FIN on the dying socket is processed while rds_conn_path_destroy() flushes cp_down_w. If the flushed pass is the one that takes this return, no later pass exists, and rds_conn_path_destroy() would find cp_conn_w still armed (WARN_ON) and then free a path whose reconnect timer can still fire. With the cancel in the branch, every exit of a shutdown pass leaves the timer quiesced no matter which pass completes the transition. The FIN case keeps making progress, one pass later and still without noisy logging. Any other state keeps today's rds_conn_path_error() handling; no current cp_state writer can leave a DISCONNECTING path in anything but RDS_CONN_ERROR (every other writer is a cmpxchg from a non-DISCONNECTING state), so that branch is defensive. On kernels without the preceding patches the same hazard exists with the sample-based quiesce; the fix applies there equally.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/260c6308fe2e19ad519389d44d582e292aecc3af
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2941561395066be856a53626d4ca973dd9c982b2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4cb9b6d3d31a2dbaa5469981c2c4c03e9acc7aca
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bd1cb197a07111ca8d4f4c21411c56a3c85a9797
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rds/connection.c",
            "net/rds/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bd1cb197a07111ca8d4f4c21411c56a3c85a9797",
              "status": "affected",
              "version": "e97656d03ca0cea888a0b9d382abce8233771f31",
              "versionType": "git"
            },
            {
              "lessThan": "4cb9b6d3d31a2dbaa5469981c2c4c03e9acc7aca",
              "status": "affected",
              "version": "e97656d03ca0cea888a0b9d382abce8233771f31",
              "versionType": "git"
            },
            {
              "lessThan": "2941561395066be856a53626d4ca973dd9c982b2",
              "status": "affected",
              "version": "e97656d03ca0cea888a0b9d382abce8233771f31",
              "versionType": "git"
            },
            {
              "lessThan": "260c6308fe2e19ad519389d44d582e292aecc3af",
              "status": "affected",
              "version": "e97656d03ca0cea888a0b9d382abce8233771f31",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rds/connection.c",
            "net/rds/tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don\u0027t let rds_conn_shutdown() consume a concurrent drop\n\nrds_conn_shutdown() finishes by moving the path from\nRDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts\nRDS_CONN_ERROR as the starting state of that final transition, so that\na FIN processed in softirq context during the teardown does not derail\nthe shutdown into a noisy error path.\n\nBut consuming that RDS_CONN_ERROR also consumes the shutdown pass that\ncame with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues\ncp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN\nis a no-op.  For the FIN case that is harmless - the socket the FIN\narrived on is the very socket the teardown just released.  It is not\nharmless for a dropper that attached something to the path first.\n\nrds_tcp_accept_one() is such a dropper.  Its path claim in\nrds_tcp_accept_one_path() transitions RDS_CONN_DOWN -\u003e\nRDS_CONN_CONNECTING, and a concurrent drop - a FIN on a previous\nsocket in softirq context, an administrative reset - can put the path\ninto RDS_CONN_ERROR between that claim and the state check that\nfollows, which accepts RDS_CONN_ERROR.  The accept then installs the\nfreshly accepted socket with rds_tcp_set_callbacks() while the queued\nteardown - which sampled tc-\u003et_sock before this socket existed - is\nstill running.  rds_connect_path_complete() fails its transition to\nRDS_CONN_UP and drops the path again, queueing the pass that should\nreap the socket it just installed.  If the in-flight shutdown\u0027s final\ntransition consumes that drop\u0027s RDS_CONN_ERROR, the queued pass finds\nthe path in RDS_CONN_DOWN and does nothing.  The installed socket is\nnever torn down: it sits established with its callbacks armed and its\nrds_tcp_connection on rds_tcp_tc_list, the peer sees a connection that\nnothing ever reads, and the path is wedged in RDS_CONN_DOWN until some\nlater event drops it again.  Reproduced with widened race windows as\nan ever-growing receive queue on a socket owned by a path stuck in\nRDS_CONN_DOWN, with the peer\u0027s send path wedged behind it.\n\nMake the final transition only DISCONNECTING -\u003e DOWN.  If it fails\nbecause the path is in RDS_CONN_ERROR, a drop raced the teardown:\ncancel the reconnect timer and clear RDS_RECONNECT_PENDING - the one\npiece of the skipped tail that must not be left behind - and return,\nletting the pass the drop queued finish the job: it tears down\nwhatever attached to the path in the meantime, completes the\ntransition to RDS_CONN_DOWN, and re-arms the reconnect from its own\ntail.\n\nThe timer quiesce in that branch matters because the racing drop does\nnot always queue that pass: rds_conn_path_drop() returns without\nqueueing when a destroy is pending - exactly the situation during a\nnetns teardown or module unload, when a FIN on the dying socket is\nprocessed while rds_conn_path_destroy() flushes cp_down_w.  If the\nflushed pass is the one that takes this return, no later pass exists,\nand rds_conn_path_destroy() would find cp_conn_w still armed\n(WARN_ON) and then free a path whose reconnect timer can still fire.\nWith the cancel in the branch, every exit of a shutdown pass leaves\nthe timer quiesced no matter which pass completes the transition.\n\nThe FIN case keeps making progress, one pass later and still without\nnoisy logging.  Any other state keeps today\u0027s rds_conn_path_error()\nhandling; no current cp_state writer can leave a DISCONNECTING path\nin anything but RDS_CONN_ERROR (every other writer is a cmpxchg from\na non-DISCONNECTING state), so that branch is defensive.\n\nOn kernels without the preceding patches the same hazard exists with\nthe sample-based quiesce; the fix applies there equally."
    }
  ],
  "id": "CVE-2026-98068",
  "lastModified": "2026-09-25T11:17:35.903",
  "metrics": {},
  "published": "2026-09-25T11:17:35.903",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/260c6308fe2e19ad519389d44d582e292aecc3af"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2941561395066be856a53626d4ca973dd9c982b2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4cb9b6d3d31a2dbaa5469981c2c4c03e9acc7aca"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bd1cb197a07111ca8d4f4c21411c56a3c85a9797"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.