CVE-2026-98429

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98429", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.348Z", "datePublished": "2026-10-14T13:27:54.960Z", "dateUpdated": "2026-10-19T09:19:24.137Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:19:24.137Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Keep EQ resources alive while IRQ is registered\n\nThe completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was\nregistered before that state was initialized, while teardown released the\nbuffer before free_irq() synchronized the handler.\n\nInitialize the EQ without arming it, register the IRQ, and then arm it.\nReverse the resource order during teardown by freeing the IRQ before\ndestroying the EQ."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/efa/efa_com.c", "drivers/infiniband/hw/efa/efa_com.h", "drivers/infiniband/hw/efa/efa_main.c"], "versions": [{"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "lessThan": "3cd652dfcd822af26ba75d6d2d245ea7f73b499e", "status": "affected", "versionType": "git"}, {"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "lessThan": "c767e2812cac83fef70fb8932c3f0fe97dff9388", "status": "affected", "versionType": "git"}, {"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "lessThan": "795eb34bfd8b1ab347adc41a11e4bb97c3ac0ce6", "status": "affected", "versionType": "git"}, {"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "lessThan": "38871ff47e2a02f8d9a333a65f358d987247b5b0", "status": "affected", "versionType": "git"}, {"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "lessThan": "9ecd3dcbdf1f315aadc049b291f59c79dc478062", "status": "affected", "versionType": "git"}, {"version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "lessThan": "e22a3627b7151754f07f90ea3d1ab6e85f5d93f4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/efa/efa_com.c", "drivers/infiniband/hw/efa/efa_com.h", "drivers/infiniband/hw/efa/efa_main.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3cd652dfcd822af26ba75d6d2d245ea7f73b499e"}, {"url": "https://git.kernel.org/stable/c/c767e2812cac83fef70fb8932c3f0fe97dff9388"}, {"url": "https://git.kernel.org/stable/c/795eb34bfd8b1ab347adc41a11e4bb97c3ac0ce6"}, {"url": "https://git.kernel.org/stable/c/38871ff47e2a02f8d9a333a65f358d987247b5b0"}, {"url": "https://git.kernel.org/stable/c/9ecd3dcbdf1f315aadc049b291f59c79dc478062"}, {"url": "https://git.kernel.org/stable/c/e22a3627b7151754f07f90ea3d1ab6e85f5d93f4"}], "title": "RDMA/efa: Keep EQ resources alive while IRQ is registered", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/efa/efa_com.c", "drivers/infiniband/hw/efa/efa_com.h", "drivers/infiniband/hw/efa/efa_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3cd652dfcd822af26ba75d6d2d245ea7f73b499e", "status": "affected", "version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "versionType": "git"}, {"lessThan": "c767e2812cac83fef70fb8932c3f0fe97dff9388", "status": "affected", "version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "versionType": "git"}, {"lessThan": "795eb34bfd8b1ab347adc41a11e4bb97c3ac0ce6", "status": "affected", "version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "versionType": "git"}, {"lessThan": "38871ff47e2a02f8d9a333a65f358d987247b5b0", "status": "affected", "version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "versionType": "git"}, {"lessThan": "9ecd3dcbdf1f315aadc049b291f59c79dc478062", "status": "affected", "version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "versionType": "git"}, {"lessThan": "e22a3627b7151754f07f90ea3d1ab6e85f5d93f4", "status": "affected", "version": "2a152512a155aaf27c3e67834ffafaed9525a7b5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/efa/efa_com.c", "drivers/infiniband/hw/efa/efa_com.h", "drivers/infiniband/hw/efa/efa_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Keep EQ resources alive while IRQ is registered\n\nThe completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was\nregistered before that state was initialized, while teardown released the\nbuffer before free_irq() synchronized the handler.\n\nInitialize the EQ without arming it, register the IRQ, and then arm it.\nReverse the resource order during teardown by freeing the IRQ before\ndestroying the EQ."}], "id": "CVE-2026-98429", "lastModified": "2026-10-19T10:18:49.570", "metrics": {}, "published": "2026-10-14T14:17:54.580", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/38871ff47e2a02f8d9a333a65f358d987247b5b0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3cd652dfcd822af26ba75d6d2d245ea7f73b499e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/795eb34bfd8b1ab347adc41a11e4bb97c3ac0ce6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ecd3dcbdf1f315aadc049b291f59c79dc478062"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c767e2812cac83fef70fb8932c3f0fe97dff9388"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e22a3627b7151754f07f90ea3d1ab6e85f5d93f4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: RDMA/efa: Keep EQ resources alive while IRQ is registered", "id": "2552203", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552203"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/efa: Keep EQ resources alive while IRQ is registered\nThe completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was\nregistered before that state was initialized, while teardown released the\nbuffer before free_irq() synchronized the handler.\nInitialize the EQ without arming it, register the IRQ, and then arm it.\nReverse the resource order during teardown by freeing the IRQ before\ndestroying the EQ.", "A flaw was found in the Linux kernel's Elastic Fabric Adapter (EFA) driver. This flaw can result in a Denial of Service (DoS) due to improper synchronization between interrupt request (IRQ) handlers and event queue resources during device initialization and teardown. Because interrupts can be serviced before the queue state is fully initialized or after its memory buffer is freed, invalid memory access can occur. A local privileged user could trigger this flaw during device setup or removal to cause a system crash."], "name": "CVE-2026-98429", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98429\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98429\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98429.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a152512a155aaf27c3e67834ffafaed9525a7b5,3cd652dfcd822af26ba75d6d2d245ea7f73b499e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a152512a155aaf27c3e67834ffafaed9525a7b5,c767e2812cac83fef70fb8932c3f0fe97dff9388)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a152512a155aaf27c3e67834ffafaed9525a7b5,795eb34bfd8b1ab347adc41a11e4bb97c3ac0ce6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a152512a155aaf27c3e67834ffafaed9525a7b5,38871ff47e2a02f8d9a333a65f358d987247b5b0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a152512a155aaf27c3e67834ffafaed9525a7b5,9ecd3dcbdf1f315aadc049b291f59c79dc478062)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2a152512a155aaf27c3e67834ffafaed9525a7b5,e22a3627b7151754f07f90ea3d1ab6e85f5d93f4)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.54,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-15T03:15:13.213573+00:00", "updated": "2026-10-19T22:30:04.600423+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}