---
id: CVE-2026-98253
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/ucma: Serialize join and leave on copy_to_user failure

  rdma_join_multicast() queues RoCE work that later reads the ucma_multicast
  through event->param.ud.private_…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/ucma: Serialize join and leave on copy_to_user failure

  rdma_join_multicast() queues RoCE work that later reads the ucma_multicast
  through event->param.ud.private_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 60d613b39e8d0c9f3b526e9c96445422b4562d76 <
    29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9
  - >-
    Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b <
    52172e11bd074ccaded21740ffeb67123f01dd00
  - >-
    Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b <
    01e29d0d78a8f66f221625720a04939eef5ec1f6
  - >-
    Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b <
    ae805d204cf1f15b87d1bf3529b4c649f3519420
  - >-
    Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b <
    43c4e24bd10370fc976f6220518049ce71419399
  - >-
    Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b <
    01cbdb724c584d7772fd25af2e4dfdf8527ce0d5
  - >-
    Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b <
    83610ee5e498fa5bfcb80031d2b959baea276bf6
  - >-
    Linux >= fe454dc31e84f8c14cb8942fcb61666c9f40745b <
    662ade4de9ff5eceb0820a9f8e9fac70ba6a815b
  - Linux a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4
  - Linux >= 5.10.20 < 5.10.271
  - Linux >= 5.11.3 < 5.12
  - Linux 5.12
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T09:18:13.887'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98253'
references:
  - url: 'https://git.kernel.org/stable/c/01cbdb724c584d7772fd25af2e4dfdf8527ce0d5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/01e29d0d78a8f66f221625720a04939eef5ec1f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/43c4e24bd10370fc976f6220518049ce71419399'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/52172e11bd074ccaded21740ffeb67123f01dd00'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/662ade4de9ff5eceb0820a9f8e9fac70ba6a815b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/83610ee5e498fa5bfcb80031d2b959baea276bf6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ae805d204cf1f15b87d1bf3529b4c649f3519420'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-06T08:50:17.430Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ucma: Serialize join and leave on copy_to_user failure

rdma_join_multicast() queues RoCE work that later reads the ucma_multicast
through event->param.ud.private_data, then list_add()s the CMA multicast
at the head of id_priv->mc_list. rdma_leave_multicast() matches only by
sockaddr and destroys the first hit.

ucma_process_join() used to drop ctx->mutex after a successful join and
retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls
with the same address can therefore insert a second CMA entry before the
first thread's leave. leave then cancels the newer work and the older
worker still dereferences the ucma_multicast that the first thread frees.

Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and,
on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join.
Do not leave if join itself failed: that path never published this address
on mc_list, and a leave-by-addr would destroy an earlier successful join.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.