CVE-2026-52939

net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

Published Jun 24, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion

rds_ib_xmit_atomic() always programs a masked atomic opcode
(IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD)
for every RDS atomic cmsg. But the completion-side switch in
rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked
atomic completion falls through to default and returns rm == NULL while
send->s_op is left set. rds_ib_send_cqe_handler() then dereferences the
NULL rm via rm->m_final_op, oopsing in softirq context. An unprivileged
AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection
triggers it; on hardware that natively accepts masked atomics (mlx4,
mlx5) no extra setup is needed.

RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR!
Oops: general protection fault [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197]
RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282)
Call Trace:
<IRQ>
rds_ib_send_cqe_handler (net/rds/ib_send.c:282)
poll_scq (net/rds/ib_cm.c:274)
rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294)
tasklet_action_common (kernel/softirq.c:943)
handle_softirqs (kernel/softirq.c:573)
run_ksoftirqd (kernel/softirq.c:479)
</IRQ>
Kernel panic - not syncing: Fatal exception in interrupt

Handle the masked atomic opcodes in the same case as the non-masked
ones: they map to the same struct rds_message.atomic union member, so
the existing container_of()/rds_ib_send_unmap_atomic() body is correct
for them.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`20c72bd5f5f902e5a8745d51573699605bf8d21c`	affected	< a0148342badd8c9b2e46551766a27cb76c82e715
`20c72bd5f5f902e5a8745d51573699605bf8d21c`	affected	< 4dd262f875e87653df50b138de1390ab0628e6b7
`20c72bd5f5f902e5a8745d51573699605bf8d21c`	affected	< 6e4615164d185a26badb2f376a2449f4d174a5f0
`20c72bd5f5f902e5a8745d51573699605bf8d21c`	affected	< 0f22412a2f4fbbe0251c132abee045d15a90e5b6
`20c72bd5f5f902e5a8745d51573699605bf8d21c`	affected	< 0f7baa82a24813cdad0b06a6f8f07e4824af5ed5
`20c72bd5f5f902e5a8745d51573699605bf8d21c`	affected	< dcf458120add64c96a6ef5cf719340453f6e6abf
`20c72bd5f5f902e5a8745d51573699605bf8d21c`	affected	< 4fd34669558085bcb589aa2078a13b0ca79e360d
`20c72bd5f5f902e5a8745d51573699605bf8d21c`	affected	< 34080db3e70ddf94c38512ad2331e3c3afca6cc1

Linux

affected

Version	Status	Constraints
`2.6.37`	affected	—
`0`	unaffected	< 2.6.37
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.94`	unaffected	≤ 6.12.*
`6.18.36`	unaffected	≤ 6.18.*
`7.0.13`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc7::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[20c72bd5f5f902e5a8745d51573699605bf8d21c,a0148342badd8c9b2e46551766a27cb76c82e715)`	affected	code_commit	—
`[20c72bd5f5f902e5a8745d51573699605bf8d21c,4dd262f875e87653df50b138de1390ab0628e6b7)`	affected	code_commit	—
`[20c72bd5f5f902e5a8745d51573699605bf8d21c,6e4615164d185a26badb2f376a2449f4d174a5f0)`	affected	code_commit	—
`[20c72bd5f5f902e5a8745d51573699605bf8d21c,0f22412a2f4fbbe0251c132abee045d15a90e5b6)`	affected	code_commit	—
`[20c72bd5f5f902e5a8745d51573699605bf8d21c,0f7baa82a24813cdad0b06a6f8f07e4824af5ed5)`	affected	code_commit	—
`[20c72bd5f5f902e5a8745d51573699605bf8d21c,dcf458120add64c96a6ef5cf719340453f6e6abf)`	affected	code_commit	—
`[20c72bd5f5f902e5a8745d51573699605bf8d21c,4fd34669558085bcb589aa2078a13b0ca79e360d)`	affected	code_commit	—
`[20c72bd5f5f902e5a8745d51573699605bf8d21c,34080db3e70ddf94c38512ad2331e3c3afca6cc1)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`2.6.37`	affected	semver	—
`[0,2.6.37)`	unaffected	semver	—
`[5.10.259,5.11.0)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.94,6.13.0)`	unaffected	semver	—
`[6.18.36,6.19.0)`	unaffected	semver	—
`[7.0.13,7.1.0)`	unaffected	semver	—
`[7.1,*)`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update
Ubuntu USN	USN-8726-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8727-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8760-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8726-3	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8800-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8760-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8726-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8903-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8904-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8905-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8903-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8905-2	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.117% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f22412a2f4fbbe0251c132abee045d15a90e5b6
https://git.kernel.org/stable/c/0f7baa82a24813cdad0b06a6f8f07e4824af5ed5
https://git.kernel.org/stable/c/34080db3e70ddf94c38512ad2331e3c3afca6cc1
https://git.kernel.org/stable/c/4dd262f875e87653df50b138de1390ab0628e6b7
https://git.kernel.org/stable/c/4fd34669558085bcb589aa2078a13b0ca79e360d
https://git.kernel.org/stable/c/6e4615164d185a26badb2f376a2449f4d174a5f0
https://git.kernel.org/stable/c/a0148342badd8c9b2e46551766a27cb76c82e715
https://git.kernel.org/stable/c/dcf458120add64c96a6ef5cf719340453f6e6abf
https://lore.kernel.org/linux-cve-announce/2026062434-CVE-2026-52939-b7cd@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-52939
https://www.cve.org/CVERecord?id=CVE-2026-52939

History

Jun 25, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026062434-CVE-2026-52939-b7cd@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-52939 https://www.cve.org/CVERecord?id=CVE-2026-52939
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Jun 24, 2026 2:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

Jun 24, 2026 7:45 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion rds_ib_xmit_atomic() always programs a masked atomic opcode (IB_WR_MASKED_ATOMIC_CMP_AND_SWP or IB_WR_MASKED_ATOMIC_FETCH_AND_ADD) for every RDS atomic cmsg. But the completion-side switch in rds_ib_send_unmap_op() only handles the non-masked opcodes, so a masked atomic completion falls through to default and returns rm == NULL while send->s_op is left set. rds_ib_send_cqe_handler() then dereferences the NULL rm via rm->m_final_op, oopsing in softirq context. An unprivileged AF_RDS sendmsg() of an atomic cmsg over an active RDS/IB connection triggers it; on hardware that natively accepts masked atomics (mlx4, mlx5) no extra setup is needed. RDS/IB: rds_ib_send_unmap_op: unexpected opcode 0xd in WR! Oops: general protection fault [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000190-0x0000000000000197] RIP: rds_ib_send_cqe_handler+0x25c/0xb10 (net/rds/ib_send.c:282) Call Trace: <IRQ> rds_ib_send_cqe_handler (net/rds/ib_send.c:282) poll_scq (net/rds/ib_cm.c:274) rds_ib_tasklet_fn_send (net/rds/ib_cm.c:294) tasklet_action_common (kernel/softirq.c:943) handle_softirqs (kernel/softirq.c:573) run_ksoftirqd (kernel/softirq.c:479) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt Handle the masked atomic opcodes in the same case as the non-masked ones: they map to the same struct rds_message.atomic union member, so the existing container_of()/rds_ib_send_unmap_atomic() body is correct for them.
Title		net/rds: fix NULL deref in rds_ib_send_cqe_handler() on masked atomic completion
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f22412a2f4fbbe0251c132abee045d15a90e5b6 https://git.kernel.org/stable/c/0f7baa82a24813cdad0b06a6f8f07e4824af5ed5 https://git.kernel.org/stable/c/34080db3e70ddf94c38512ad2331e3c3afca6cc1 https://git.kernel.org/stable/c/4dd262f875e87653df50b138de1390ab0628e6b7 https://git.kernel.org/stable/c/4fd34669558085bcb589aa2078a13b0ca79e360d https://git.kernel.org/stable/c/6e4615164d185a26badb2f376a2449f4d174a5f0 https://git.kernel.org/stable/c/a0148342badd8c9b2e46551766a27cb76c82e715 https://git.kernel.org/stable/c/dcf458120add64c96a6ef5cf719340453f6e6abf