net/rds: clear cp_flags bits individually in rds_conn_path_reset()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98071
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-25 11:17:36 UTC
Updated2026-10-19 10:18:02 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/rds: clear cp_flags bits individually in rds_conn_path_reset() rds_conn_path_reset() wipes the whole flag word with a plain cp->cp_flags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrently with the reset: RDS_LL_SEND_FULL is set from rds_send_xmit() and cleared from the transport completion paths, neither of which holds anything that excludes the shutdown worker. A plain store racing an atomic read-modify-write on the same word is a data race, and whichever side loses has its update silently discarded. Clear the two bits the reset is actually responsible for instead. RDS_IN_XMIT and RDS_RECV_REFILL need no store at all here: they belong to the caller, rds_conn_shutdown(), which waits for both to be clear before calling the transport shutdown and this reset. This also gives every bit in cp_flags a single well-defined writer discipline, which the following patches rely on when they turn RDS_IN_XMIT and RDS_RECV_REFILL into bit locks held across the teardown: a blanket store mid-teardown would destroy lock ownership that an atomic clear preserves. Oracle UEK carries the same conversion ("net/rds: Preserve essential connection state flags"), motivated by its asynchronous shutdown state machine, whose progress and destroy flags must survive the reset. UEK's variant also clears RDS_IN_XMIT and RDS_RECV_REFILL because there the reset runs as the final step of a teardown that owns both bits, making those clears its unlock. Upstream that release belongs in rds_conn_shutdown(): once a later patch in this series turns the two bits into locks held across the teardown, ending ownership needs release semantics and a wake-up that a plain clear inside the reset would not provide. Based on Oracle UEK commit "net/rds: Preserve essential connection state flags" by Gerd Rausch.

Risk And Classification

EPSS: 0.001760000 probability, percentile 0.065320000 (date 2026-10-05)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 00e0f34c616603ba6500f41943cbf89eb4a8a5be c9a7c1eb0ad41dcf004a9e870e452cafedcd9172 git Not specified
CNA Linux Linux affected 00e0f34c616603ba6500f41943cbf89eb4a8a5be b767b48614c38687d717082860de7aa46f3b142c git Not specified
CNA Linux Linux affected 00e0f34c616603ba6500f41943cbf89eb4a8a5be b7dc5da660eb5ffa7f7b4d33f2c74cb71c6edd6c git Not specified
CNA Linux Linux affected 00e0f34c616603ba6500f41943cbf89eb4a8a5be b8a8b6d25e7426a638c60eaba2129c0664131e84 git Not specified
CNA Linux Linux affected 00e0f34c616603ba6500f41943cbf89eb4a8a5be ed3ee0ac4aafda50c2f4381eb973beefeb7879ac git Not specified
CNA Linux Linux affected 00e0f34c616603ba6500f41943cbf89eb4a8a5be 6b8d7563c28b8112e6e54abe413b028ef3f8c549 git Not specified
CNA Linux Linux affected 00e0f34c616603ba6500f41943cbf89eb4a8a5be cb62aa8f04655a4df487913949719c0a1266ed73 git Not specified
CNA Linux Linux affected 00e0f34c616603ba6500f41943cbf89eb4a8a5be 103c4b13c4f50322910078d1c02f29334a574122 git Not specified
CNA Linux Linux affected 2.6.30 Not specified
CNA Linux Linux unaffected 2.6.30 semver Not specified
CNA Linux Linux unaffected 5.10.271 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.222 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.189 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.158 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.111 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.53 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.7 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/c9a7c1eb0ad41dcf004a9e870e452cafedcd9172 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b7dc5da660eb5ffa7f7b4d33f2c74cb71c6edd6c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b8a8b6d25e7426a638c60eaba2129c0664131e84 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/103c4b13c4f50322910078d1c02f29334a574122 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ed3ee0ac4aafda50c2f4381eb973beefeb7879ac 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6b8d7563c28b8112e6e54abe413b028ef3f8c549 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b767b48614c38687d717082860de7aa46f3b142c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cb62aa8f04655a4df487913949719c0a1266ed73 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report