CVE-2026-98253RDMA/ucma: Serialize join and leave on copy_to_user failure
- 7.8HighCVSS base score
- 0.13%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copy_to_user failure rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s the CMA multicast at the head of id_priv->mc_list. rdma_leave_multicast() matches only by sockaddr and destroys the first hit. ucma_process_join() used to drop ctx->mutex after a successful join and retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucma_multicast that the first thread frees. Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and, on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mc_list, and a leave-by-addr would destroy an earlier successful join.
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 13 days later
· 13 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.13% · top 97% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected 60d613b39e8d0c9f3b526e9c96445422b4562d76 – < 29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9
- affected fe454dc31e84f8c14cb8942fcb61666c9f40745b – < 52172e11bd074ccaded21740ffeb67123f01dd00
- affected fe454dc31e84f8c14cb8942fcb61666c9f40745b – < 01e29d0d78a8f66f221625720a04939eef5ec1f6
- affected fe454dc31e84f8c14cb8942fcb61666c9f40745b – < ae805d204cf1f15b87d1bf3529b4c649f3519420
- affected fe454dc31e84f8c14cb8942fcb61666c9f40745b – < 43c4e24bd10370fc976f6220518049ce71419399
- affected fe454dc31e84f8c14cb8942fcb61666c9f40745b – < 01cbdb724c584d7772fd25af2e4dfdf8527ce0d5
- affected fe454dc31e84f8c14cb8942fcb61666c9f40745b – < 83610ee5e498fa5bfcb80031d2b959baea276bf6
- affected fe454dc31e84f8c14cb8942fcb61666c9f40745b – < 662ade4de9ff5eceb0820a9f8e9fac70ba6a815b
- affected a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4
- affected 5.10.20 – < 5.10.271
- affected 5.11.3 – < 5.12
- affected 5.12
- unaffected < 5.12
- unaffected 5.10.271 – ≤ 5.10.*
- unaffected 5.15.222 – ≤ 5.15.*
- unaffected 6.1.189 – ≤ 6.1.*
- unaffected 6.6.158 – ≤ 6.6.*
- unaffected 6.12.112 – ≤ 6.12.*
- unaffected 6.18.54 – ≤ 6.18.*
- unaffected 7.2.8 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9 (opens in a new tab)
- https://git.kernel.org/stable/c/52172e11bd074ccaded21740ffeb67123f01dd00 (opens in a new tab)
- https://git.kernel.org/stable/c/01e29d0d78a8f66f221625720a04939eef5ec1f6 (opens in a new tab)
- https://git.kernel.org/stable/c/ae805d204cf1f15b87d1bf3529b4c649f3519420 (opens in a new tab)
- https://git.kernel.org/stable/c/43c4e24bd10370fc976f6220518049ce71419399 (opens in a new tab)
- https://git.kernel.org/stable/c/01cbdb724c584d7772fd25af2e4dfdf8527ce0d5 (opens in a new tab)
- https://git.kernel.org/stable/c/83610ee5e498fa5bfcb80031d2b959baea276bf6 (opens in a new tab)
- https://git.kernel.org/stable/c/662ade4de9ff5eceb0820a9f8e9fac70ba6a815b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-93181 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98253)Record last updated .