net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99212
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-28 11:17:42 UTC
Updated2026-10-31 13:17:59 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE route with no usable device - makes addr_handler() destroy the id the event was delivered on. That id is ic->i_cm_id, and nothing clears the pointer: the connection sits in RDS_CONN_CONNECTING with a freed id until its shutdown calls rdma_disconnect() and rdma_destroy_id() on it. The ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect() forces a zero return while ic->i_cm_id == cm_id, as the comment there explains. Do the same here - drop the connection and return 0 - so the id stays RDS's to destroy from the shutdown, and the reconnect gets a fresh one.

Risk And Classification

Primary CVSS: v3.1 7 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001670000 probability, percentile 0.059320000 (date 2026-10-31)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea 664fd3205cbec71ac52c005ee705cd917bb6fb1a git Not specified
CNA Linux Linux affected 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea b8f141f65885810e24fc23b8a71692db62d535bf git Not specified
CNA Linux Linux affected 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea e677eda15df7d5ce256654343418043c7ffd6f9b git Not specified
CNA Linux Linux affected 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea 92143c5d80382588d5a3047a4f14023ee9ef6485 git Not specified
CNA Linux Linux affected 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea a7c7d0ff876377fea7ae876a28d6df8d9349df57 git Not specified
CNA Linux Linux affected 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea 91ece3efa064f0b3b3c67b9b045d9eeb4a034e43 git Not specified
CNA Linux Linux affected 55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea 98d446b7c013254a8a7b49720557676a3a851fde git Not specified
CNA Linux Linux affected 2.6.30 Not specified
CNA Linux Linux unaffected 2.6.30 semver Not specified
CNA Linux Linux unaffected 5.15.224 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.161 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.115 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.59 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.13 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/e677eda15df7d5ce256654343418043c7ffd6f9b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/92143c5d80382588d5a3047a4f14023ee9ef6485 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b8f141f65885810e24fc23b8a71692db62d535bf 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/664fd3205cbec71ac52c005ee705cd917bb6fb1a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report