- —Not scoredno CVSS score yet
- 0.18%Exploitation in 30 daysEPSS · top 92% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but the event switch dereferences it: unconditionally in the RDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(), and (with a connection context) in the ROUTE_RESOLVED and ESTABLISHED cases. An RDS listener on an iWARP device therefore crashes the kernel as soon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO the wild load becomes a NULL dereference at offset 0xa0 (&trans->cm_handle_connect) in the iw_cm_wq workqueue. GCC masks the bug in default builds by folding the uninitialized load into &rds_ib_transport; Clang-built kernels take the real uninitialized path and oops. The active side can land on a non-IB device too: the id that rds_ib_conn_path_connect() creates is not restricted to a node type, so rdma_resolve_addr() binds it to whichever device serves the local address, and an iWARP RNIC on the same netdev qualifies. The crash there is different: resolving a route on an iWARP id never fills in cm_id->route.path_rec, and the ROUTE_RESOLVED case writes path_rec[0].sl before it calls into the transport. The iWARP transport was dropped long ago and IB is the only transport left, so make that explicit: initialize trans to &rds_ib_transport at declaration, drop the conditional assignment, reject a connect request that arrives on a non-IB device, and drop a connection whose address resolved to one instead of resolving a route on it. The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUEST on purpose: a non-zero return from the handler makes rdma_cm destroy the id the event was delivered on, which is right for the request's freshly created id but would free a connection id that RDS still owns for any other event. On the active side the id stays ic->i_cm_id and the connection's shutdown destroys it, so that case returns 0. [achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of bailing out for every event on a non-IB device, so that rdma_cm does not destroy connection ids RDS still tracks; drop a connection whose address resolved to a non-IB device before a route is resolved on it; changelog adjusted]
Timeline
ID reserved
By Linux
- 33 days later
· 33 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.18% · top 92% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected dcdede0406d30e14a6ed727dce69dfac0518371d – < 0d15e853aa88da5375edd32b39d08a048b64a1c5
- affected dcdede0406d30e14a6ed727dce69dfac0518371d – < 8c77774535c3d6162929521a6fa11e3db086fa32
- affected dcdede0406d30e14a6ed727dce69dfac0518371d – < 8973f70cb068012d83cff1cfa3f45ef94ab02267
- affected dcdede0406d30e14a6ed727dce69dfac0518371d – < a2fde862b98db8908e2ebaffbb35a75a0e9d5b33
- affected dcdede0406d30e14a6ed727dce69dfac0518371d – < 074bb7cdc3e26afa698888ba56fc1df0e3f24650
- affected dcdede0406d30e14a6ed727dce69dfac0518371d – < 5f23e4e3a31dacfd82a8f56be253adc0910ee84f
- affected dcdede0406d30e14a6ed727dce69dfac0518371d – < ca14c289ed9ffed6cc64290d039e923e5720a8bf
- affected dcdede0406d30e14a6ed727dce69dfac0518371d – < 492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8
- affected 4.6
- unaffected < 4.6
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.161 – ≤ 6.6.*
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.59 – ≤ 6.18.*
- unaffected 7.2.13 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References8
- https://git.kernel.org/stable/c/0d15e853aa88da5375edd32b39d08a048b64a1c5 (opens in a new tab)
- https://git.kernel.org/stable/c/8c77774535c3d6162929521a6fa11e3db086fa32 (opens in a new tab)
- https://git.kernel.org/stable/c/8973f70cb068012d83cff1cfa3f45ef94ab02267 (opens in a new tab)
- https://git.kernel.org/stable/c/a2fde862b98db8908e2ebaffbb35a75a0e9d5b33 (opens in a new tab)
- https://git.kernel.org/stable/c/074bb7cdc3e26afa698888ba56fc1df0e3f24650 (opens in a new tab)
- https://git.kernel.org/stable/c/5f23e4e3a31dacfd82a8f56be253adc0910ee84f (opens in a new tab)
- https://git.kernel.org/stable/c/ca14c289ed9ffed6cc64290d039e923e5720a8bf (opens in a new tab)
- https://git.kernel.org/stable/c/492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-111918 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-99166)Record last updated .