VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
c1444140e59c61ba154436ea0cd6284d8a97c3f0
vuln-cve/data/2026/98xxx/CVE-2026-98068.json
T

250 lines
15 KiB
JSON
Raw Blame History

{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-98068",
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"state": "PUBLISHED",
"assignerShortName": "Linux",
"dateReserved": "2026-09-25T10:19:56.074Z",
"datePublished": "2026-09-25T10:24:10.234Z",
"dateUpdated": "2026-10-19T09:13:17.906Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux",
"dateUpdated": "2026-10-19T09:13:17.906Z"
},
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let rds_conn_shutdown() consume a concurrent drop\n\nrds_conn_shutdown() finishes by moving the path from\nRDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts\nRDS_CONN_ERROR as the starting state of that final transition, so that\na FIN processed in softirq context during the teardown does not derail\nthe shutdown into a noisy error path.\n\nBut consuming that RDS_CONN_ERROR also consumes the shutdown pass that\ncame with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues\ncp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN\nis a no-op. For the FIN case that is harmless - the socket the FIN\narrived on is the very socket the teardown just released. It is not\nharmless for a dropper that attached something to the path first.\n\nrds_tcp_accept_one() is such a dropper. Its path claim in\nrds_tcp_accept_one_path() transitions RDS_CONN_DOWN ->\nRDS_CONN_CONNECTING, and a concurrent drop - a FIN on a previous\nsocket in softirq context, an administrative reset - can put the path\ninto RDS_CONN_ERROR between that claim and the state check that\nfollows, which accepts RDS_CONN_ERROR. The accept then installs the\nfreshly accepted socket with rds_tcp_set_callbacks() while the queued\nteardown - which sampled tc->t_sock before this socket existed - is\nstill running. rds_connect_path_complete() fails its transition to\nRDS_CONN_UP and drops the path again, queueing the pass that should\nreap the socket it just installed. If the in-flight shutdown's final\ntransition consumes that drop's RDS_CONN_ERROR, the queued pass finds\nthe path in RDS_CONN_DOWN and does nothing. The installed socket is\nnever torn down: it sits established with its callbacks armed and its\nrds_tcp_connection on rds_tcp_tc_list, the peer sees a connection that\nnothing ever reads, and the path is wedged in RDS_CONN_DOWN until some\nlater event drops it again. Reproduced with widened race windows as\nan ever-growing receive queue on a socket owned by a path stuck in\nRDS_CONN_DOWN, with the peer's send path wedged behind it.\n\nMake the final transition only DISCONNECTING -> DOWN. If it fails\nbecause the path is in RDS_CONN_ERROR, a drop raced the teardown:\ncancel the reconnect timer and clear RDS_RECONNECT_PENDING - the one\npiece of the skipped tail that must not be left behind - and return,\nletting the pass the drop queued finish the job: it tears down\nwhatever attached to the path in the meantime, completes the\ntransition to RDS_CONN_DOWN, and re-arms the reconnect from its own\ntail.\n\nThe timer quiesce in that branch matters because the racing drop does\nnot always queue that pass: rds_conn_path_drop() returns without\nqueueing when a destroy is pending - exactly the situation during a\nnetns teardown or module unload, when a FIN on the dying socket is\nprocessed while rds_conn_path_destroy() flushes cp_down_w. If the\nflushed pass is the one that takes this return, no later pass exists,\nand rds_conn_path_destroy() would find cp_conn_w still armed\n(WARN_ON) and then free a path whose reconnect timer can still fire.\nWith the cancel in the branch, every exit of a shutdown pass leaves\nthe timer quiesced no matter which pass completes the transition.\n\nThe FIN case keeps making progress, one pass later and still without\nnoisy logging. Any other state keeps today's rds_conn_path_error()\nhandling; no current cp_state writer can leave a DISCONNECTING path\nin anything but RDS_CONN_ERROR (every other writer is a cmpxchg from\na non-DISCONNECTING state), so that branch is defensive.\n\nOn kernels without the preceding patches the same hazard exists with\nthe sample-based quiesce; the fix applies there equally."
}
],
"affected": [
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/rds/connection.c",
"net/rds/tcp.c"
],
"versions": [
{
"version": "e97656d03ca0cea888a0b9d382abce8233771f31",
"lessThan": "f777c602d3e15d3414b53f760147687bd56b03f2",
"status": "affected",
"versionType": "git"
},
{
"version": "e97656d03ca0cea888a0b9d382abce8233771f31",
"lessThan": "7cb11257aa3e5ef0bedfd5d55ac60bb00347aa97",
"status": "affected",
"versionType": "git"
},
{
"version": "e97656d03ca0cea888a0b9d382abce8233771f31",
"lessThan": "4980ce260205001d582a7b3cb5eab29877777fbc",
"status": "affected",
"versionType": "git"
},
{
"version": "e97656d03ca0cea888a0b9d382abce8233771f31",
"lessThan": "0ec75c69918b7f6a1a5e3fb6442925246a9ec86b",
"status": "affected",
"versionType": "git"
},
{
"version": "e97656d03ca0cea888a0b9d382abce8233771f31",
"lessThan": "bd1cb197a07111ca8d4f4c21411c56a3c85a9797",
"status": "affected",
"versionType": "git"
},
{
"version": "e97656d03ca0cea888a0b9d382abce8233771f31",
"lessThan": "4cb9b6d3d31a2dbaa5469981c2c4c03e9acc7aca",
"status": "affected",
"versionType": "git"
},
{
"version": "e97656d03ca0cea888a0b9d382abce8233771f31",
"lessThan": "2941561395066be856a53626d4ca973dd9c982b2",
"status": "affected",
"versionType": "git"
},
{
"version": "e97656d03ca0cea888a0b9d382abce8233771f31",
"lessThan": "260c6308fe2e19ad519389d44d582e292aecc3af",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/rds/connection.c",
"net/rds/tcp.c"
],
"versions": [
{
"version": "4.12",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.12",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.10.271",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "5.15.222",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "6.18.53",
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.2.7",
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"versionType": "semver"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12",
"versionEndExcluding": "5.10.271"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12",
"versionEndExcluding": "5.15.222"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12",
"versionEndExcluding": "6.1.189"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12",
"versionEndExcluding": "6.6.158"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12",
"versionEndExcluding": "6.12.111"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12",
"versionEndExcluding": "6.18.53"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12",
"versionEndExcluding": "7.2.7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.12",
"versionEndExcluding": "7.3"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/f777c602d3e15d3414b53f760147687bd56b03f2"
},
{
"url": "https://git.kernel.org/stable/c/7cb11257aa3e5ef0bedfd5d55ac60bb00347aa97"
},
{
"url": "https://git.kernel.org/stable/c/4980ce260205001d582a7b3cb5eab29877777fbc"
},
{
"url": "https://git.kernel.org/stable/c/0ec75c69918b7f6a1a5e3fb6442925246a9ec86b"
},
{
"url": "https://git.kernel.org/stable/c/bd1cb197a07111ca8d4f4c21411c56a3c85a9797"
},
{
"url": "https://git.kernel.org/stable/c/4cb9b6d3d31a2dbaa5469981c2c4c03e9acc7aca"
},
{
"url": "https://git.kernel.org/stable/c/2941561395066be856a53626d4ca973dd9c982b2"
},
{
"url": "https://git.kernel.org/stable/c/260c6308fe2e19ad519389d44d582e292aecc3af"
}
],
"title": "net/rds: don't let rds_conn_shutdown() consume a concurrent drop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
}
}
View Git Blame Copy Permalink