{"id":"CVE-2026-98253","published":"2026-10-06T09:18:13.887","lastModified":"2026-10-07T07:17:06.530","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Serialize join and leave on copy_to_user failure\n\nrdma_join_multicast() queues RoCE work that later reads the ucma_multicast\nthrough event->param.ud.private_data, then list_add()s the CMA multicast\nat the head of id_priv->mc_list. rdma_leave_multicast() matches only by\nsockaddr and destroys the first hit.\n\nucma_process_join() used to drop ctx->mutex after a successful join and\nretake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls\nwith the same address can therefore insert a second CMA entry before the\nfirst thread's leave. leave then cancels the newer work and the older\nworker still dereferences the ucma_multicast that the first thread frees.\n\nKeep ctx->mutex held from rdma_join_multicast() through copy_to_user() and,\non -EFAULT, through rdma_leave_multicast() so leave cannot miss this join.\nDo not leave if join itself failed: that path never published this address\non mc_list, and a leave-by-addr would destroy an earlier successful join.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/01cbdb724c584d7772fd25af2e4dfdf8527ce0d5","tags":[]},{"url":"https://git.kernel.org/stable/c/01e29d0d78a8f66f221625720a04939eef5ec1f6","tags":[]},{"url":"https://git.kernel.org/stable/c/29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9","tags":[]},{"url":"https://git.kernel.org/stable/c/43c4e24bd10370fc976f6220518049ce71419399","tags":[]},{"url":"https://git.kernel.org/stable/c/52172e11bd074ccaded21740ffeb67123f01dd00","tags":[]},{"url":"https://git.kernel.org/stable/c/662ade4de9ff5eceb0820a9f8e9fac70ba6a815b","tags":[]},{"url":"https://git.kernel.org/stable/c/83610ee5e498fa5bfcb80031d2b959baea276bf6","tags":[]},{"url":"https://git.kernel.org/stable/c/ae805d204cf1f15b87d1bf3529b4c649f3519420","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's RDMA/ucma component has a race condition where concurrent multicast join operations can lead to improper cleanup of multicast entries, potentially causing use-after-free conditions and system instability. This occurs when one thread joins a multicast group while another leaves it, with the leave operation incorrectly freeing memory that the first thread still needs.","exploitability":"Exploitation is moderately difficult and requires concurrent access to the same multicast address from multiple threads, likely involving RDMA/UCMA operations in a multi-threaded environment with specific timing conditions.","blast_radius":"The vulnerability could affect systems using RDMA over Converged Ethernet (RoCE) with multicast operations, potentially leading to kernel crashes, memory corruption, or denial of service conditions in high-performance computing environments.","remediation":"Upgrade to Linux kernel version 6.10 or later which contains the fix for this race condition in RDMA/ucma multicast handling.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","rdma","multicast","race-condition"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:04:53.531Z"}}