---
id: CVE-2026-98070
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

  rds_tcp_reset_callbacks() quiesces the transmit path by setting the
  path state to RDS_CONN_RESETTING and then…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

  rds_tcp_reset_callbacks() quiesces the transmit path by setting the
  path state to RDS_CONN_RESETTING and then…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 335b48d980f631fbc5b233cbb3625ac0c86d67cb <
    d625112564c3e980e02504270222b49b82690cee
  - >-
    Linux >= 335b48d980f631fbc5b233cbb3625ac0c86d67cb <
    8e4c3b7844c906c7097b4cfedd9dd1f48c9a6a92
  - >-
    Linux >= 335b48d980f631fbc5b233cbb3625ac0c86d67cb <
    062d9e008c67289e8e1b221ecdd8f9d60566d012
  - >-
    Linux >= 335b48d980f631fbc5b233cbb3625ac0c86d67cb <
    02c5f9dc2efd823e061954d564ce00bacd1bebeb
  - Linux 4.7
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:18:05.427'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98070'
references:
  - url: 'https://git.kernel.org/stable/c/02c5f9dc2efd823e061954d564ce00bacd1bebeb'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/062d9e008c67289e8e1b221ecdd8f9d60566d012'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e4c3b7844c906c7097b4cfedd9dd1f48c9a6a92'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d625112564c3e980e02504270222b49b82690cee'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.840Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

rds_tcp_reset_callbacks() quiesces the transmit path by setting the
path state to RDS_CONN_RESETTING and then waiting for RDS_IN_XMIT to
be sampled clear before swapping the underlying socket and calling
rds_send_path_reset().

Sampling the bit clear is not the same as owning it: rds_send_xmit()
can re-acquire RDS_IN_XMIT right after the wait_event() returns.  Its
state recheck after taking the lock is a store-buffering pattern (the
resetter writes the state and reads the bit, the sender writes the
bit and reads the state) and acquire_in_xmit() is only an acquire
operation, so on weakly ordered architectures both sides can miss
each other's write and the transmit path then runs concurrently with
rds_send_path_reset() rewriting cp_xmit_* state - which is exactly
what the comment above rds_send_path_reset() tells its callers to
prevent.

Take the lock instead, hold it across the socket swap and
rds_send_path_reset(), and release it with a wake-up at the end.  The
lock-ordering constraint documented above the wait still holds: the
lock is acquired before lock_sock(), so a sender inside tcp_sendmsg()
can never be waited on while we hold the socket lock.

Two details of the old code go away with the same change:

 - t_sock is now read only after the lock is acquired.  The old code
   cached it before waiting; the teardown in rds_conn_shutdown()
   releases that socket and clears t_sock, so a pointer cached before
   the wait can be stale by the time the accept path resumes.  Reading
   it under RDS_IN_XMIT is what makes the exclusion complete once the
   teardown owns the same lock, which the next patch arranges; until
   then the teardown still only samples the bit, and the two paths
   remain as exposed to each other as they are today.

 - The old !osock early path called rds_send_path_reset() with no
   serialization at all.  It now runs under the lock like the normal
   path.  The conditional RDS_CONN_RESETTING transition of the
   previous patch happens before the socket check either way: a path
   found without a socket is either still connecting (its reconnect
   worker blocked on t_conn_path_lock) and legitimately goes
   RESETTING -> UP on the new socket, or it has been torn down
   meanwhile and is dropped.

The in-function comment describing the old wait-based quiesce is
rewritten to describe the lock-based one, and the stale block comment
above the function (which still described a return value and an
incomplete list of t_sock writers) is refreshed to name all four
writers - the connect, accept, teardown and swap paths - and what
serializes each of them.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.