CVE-2026-98560

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98560", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.357Z", "datePublished": "2026-10-18T15:18:27.162Z", "dateUpdated": "2026-10-19T09:21:44.401Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:44.401Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: size a connection's path set by the transport it ends up with\n\n__rds_conn_create() computes npaths from the caller's transport before\nit decides whether a connection to one of the host's own addresses is\nto be handled by the loopback transport instead. That substitution is\nwhat an RDS/TCP socket sending to a local address gets, and after it\nthe path init loop still runs for the TCP transport's RDS_MPATH_WORKERS\npaths and allocates an ordered workqueue for each, while\nrds_loop_conn_alloc() only ever provides transport data for path 0.\n\nrds_conn_destroy() sizes its teardown from c_trans, by then the\nloopback transport, so it visits path 0 only - and\nrds_conn_path_destroy() would skip the other paths anyway, since it\nreturns before destroy_workqueue() for a path without transport data.\nkfree(c_path) then drops the last pointers to seven workqueues. That\nrepeats for every such connection, on every netns teardown or module\nunload, and every distinct local destination address is a separate\nconnection.\n\nRecompute npaths once the transport is final, so that creation and\ndestruction agree on the set of paths. The c_path array stays sized\nfor the caller's transport; the unused entries are freed with it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/connection.c"], "versions": [{"version": "4716af3897e95997d08183d351cece2dec9ee0c0", "lessThan": "670f303169d2d36f315c40f6d3d18b5ee8498fea", "status": "affected", "versionType": "git"}, {"version": "4716af3897e95997d08183d351cece2dec9ee0c0", "lessThan": "ba3d1f480c7a3fba963e7867ad6cc557c197acbc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/connection.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/670f303169d2d36f315c40f6d3d18b5ee8498fea"}, {"url": "https://git.kernel.org/stable/c/ba3d1f480c7a3fba963e7867ad6cc557c197acbc"}], "title": "net/rds: size a connection's path set by the transport it ends up with", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rds/connection.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "670f303169d2d36f315c40f6d3d18b5ee8498fea", "status": "affected", "version": "4716af3897e95997d08183d351cece2dec9ee0c0", "versionType": "git"}, {"lessThan": "ba3d1f480c7a3fba963e7867ad6cc557c197acbc", "status": "affected", "version": "4716af3897e95997d08183d351cece2dec9ee0c0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rds/connection.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: size a connection's path set by the transport it ends up with\n\n__rds_conn_create() computes npaths from the caller's transport before\nit decides whether a connection to one of the host's own addresses is\nto be handled by the loopback transport instead. That substitution is\nwhat an RDS/TCP socket sending to a local address gets, and after it\nthe path init loop still runs for the TCP transport's RDS_MPATH_WORKERS\npaths and allocates an ordered workqueue for each, while\nrds_loop_conn_alloc() only ever provides transport data for path 0.\n\nrds_conn_destroy() sizes its teardown from c_trans, by then the\nloopback transport, so it visits path 0 only - and\nrds_conn_path_destroy() would skip the other paths anyway, since it\nreturns before destroy_workqueue() for a path without transport data.\nkfree(c_path) then drops the last pointers to seven workqueues. That\nrepeats for every such connection, on every netns teardown or module\nunload, and every distinct local destination address is a separate\nconnection.\n\nRecompute npaths once the transport is final, so that creation and\ndestruction agree on the set of paths. The c_path array stays sized\nfor the caller's transport; the unused entries are freed with it."}], "id": "CVE-2026-98560", "lastModified": "2026-10-19T10:19:12.577", "metrics": {}, "published": "2026-10-18T16:17:08.143", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/670f303169d2d36f315c40f6d3d18b5ee8498fea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba3d1f480c7a3fba963e7867ad6cc557c197acbc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/rds: size a connection's path set by the transport it ends up with", "id": "2554931", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554931"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/rds: size a connection's path set by the transport it ends up with\n__rds_conn_create() computes npaths from the caller's transport before\nit decides whether a connection to one of the host's own addresses is\nto be handled by the loopback transport instead. That substitution is\nwhat an RDS/TCP socket sending to a local address gets, and after it\nthe path init loop still runs for the TCP transport's RDS_MPATH_WORKERS\npaths and allocates an ordered workqueue for each, while\nrds_loop_conn_alloc() only ever provides transport data for path 0.\nrds_conn_destroy() sizes its teardown from c_trans, by then the\nloopback transport, so it visits path 0 only - and\nrds_conn_path_destroy() would skip the other paths anyway, since it\nreturns before destroy_workqueue() for a path without transport data.\nkfree(c_path) then drops the last pointers to seven workqueues. That\nrepeats for every such connection, on every netns teardown or module\nunload, and every distinct local destination address is a separate\nconnection.\nRecompute npaths once the transport is final, so that creation and\ndestruction agree on the set of paths. The c_path array stays sized\nfor the caller's transport; the unused entries are freed with it.", "A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When handling local connections, the system miscalculates the required communication paths, allocating internal work queues that are not properly freed during connection teardown. A local user can exploit this vulnerability by repeatedly opening and closing local connections, triggering a kernel memory leak that can lead to resource exhaustion and a Denial of Service (DoS)."], "name": "CVE-2026-98560", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98560\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98560\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98560.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4716af3897e95997d08183d351cece2dec9ee0c0,670f303169d2d36f315c40f6d3d18b5ee8498fea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4716af3897e95997d08183d351cece2dec9ee0c0,ba3d1f480c7a3fba963e7867ad6cc557c197acbc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:15:14.331079+00:00", "updated": "2026-10-20T19:30:07.041611+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-772"]}