{"id":"CVE-2026-98253","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Serialize join and leave on copy_to_user failure\n\nrdma_join_multicast() queues RoCE work that later reads the ucma_multicast\nthrough event->param.ud.private_…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Serialize join and leave on copy_to_user failure\n\nrdma_join_multicast() queues RoCE work that later reads the ucma_multicast\nthrough event->param.ud.private_…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 60d613b39e8d0c9f3b526e9c96445422b4562d76 < 29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9","Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 52172e11bd074ccaded21740ffeb67123f01dd00","Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 01e29d0d78a8f66f221625720a04939eef5ec1f6","Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < ae805d204cf1f15b87d1bf3529b4c649f3519420","Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 43c4e24bd10370fc976f6220518049ce71419399","Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 01cbdb724c584d7772fd25af2e4dfdf8527ce0d5","Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 83610ee5e498fa5bfcb80031d2b959baea276bf6","Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b < 662ade4de9ff5eceb0820a9f8e9fac70ba6a815b","Linux a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4","Linux >= 5.10.20 < 5.10.271","Linux >= 5.11.3 < 5.12","Linux 5.12"],"published":"2026-10-06","updated":"2026-10-06","sourceUpdated":"2026-10-06T09:18:13.887","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98253","references":[{"url":"https://git.kernel.org/stable/c/01cbdb724c584d7772fd25af2e4dfdf8527ce0d5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/01e29d0d78a8f66f221625720a04939eef5ec1f6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/43c4e24bd10370fc976f6220518049ce71419399","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52172e11bd074ccaded21740ffeb67123f01dd00","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/662ade4de9ff5eceb0820a9f8e9fac70ba6a815b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83610ee5e498fa5bfcb80031d2b959baea276bf6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae805d204cf1f15b87d1bf3529b4c649f3519420","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-06T08:50:17.430Z","slug":"CVE-2026-98253","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/ucma: Serialize join and leave on copy_to_user failure\n\nrdma_join_multicast() queues RoCE work that later reads the ucma_multicast\nthrough event->param.ud.private_data, then list_add()s the CMA multicast\nat the head of id_priv->mc_list. rdma_leave_multicast() matches only by\nsockaddr and destroys the first hit.\n\nucma_process_join() used to drop ctx->mutex after a successful join and\nretake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls\nwith the same address can therefore insert a second CMA entry before the\nfirst thread's leave. leave then cancels the newer work and the older\nworker still dereferences the ucma_multicast that the first thread frees.\n\nKeep ctx->mutex held from rdma_join_multicast() through copy_to_user() and,\non -EFAULT, through rdma_leave_multicast() so leave cannot miss this join.\nDo not leave if join itself failed: that path never published this address\non mc_list, and a leave-by-addr would destroy an earlier successful join.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}