{"api_version":"1","generated_at":"2026-10-21T23:06:33+00:00","cve":"CVE-2026-98431","urls":{"html":"https://cve.report/CVE-2026-98431","api":"https://cve.report/api/cve/CVE-2026-98431.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98431","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98431"},"summary":{"title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency\n\nCommit 51976c6cd786 (\"RDMA/core: Provide rdma_user_mmap_disassociate()\nto disassociate mmap pages\") introduced disassociation_lock to protect\nnew mmap registrations against uverbs_user_mmap_disassociate(), but\ncreated an ABBA deadlock:\n\n  Thread A (mmap / fork):\n    mmap_lock -> disassociation_lock\n\n  Thread B (disassociate):\n    disassociation_lock -> mmap_lock\n\nFix by removing disassociation_lock entirely and using the pre-existing\nhw_destroy_rwsem instead. hw_destroy_rwsem already provides the same\nprotection: rdma_umap_open() and ib_uverbs_mmap() both use\ndown_read_trylock() before registering a new VMA, so holding hw_destroy_rwsem\nin uverbs_user_mmap_disassociate() is sufficient to block new registrations.\ntrylock is used in both mmap paths (not blocking down_read) because\nmmap_lock is already held on entry, and uverbs_user_mmap_disassociate()\nacquires mmap_lock internally — a blocking read would recreate the same\ndeadlock.\n\nThe only caller that was not taking hw_destroy_rwsem for write was\nrdma_user_mmap_disassociate(). Fix it to take the rwsem per-ufile while\niterating under lists_mutex.  This is safe because ib_uverbs_close()\nreleases hw_destroy_rwsem entirely before acquiring lists_mutex, so the\ntwo locks are never held simultaneously.\n\nlockdep warning:\n\n [  776.654252] ======================================================\n [  776.655214] WARNING: possible circular locking dependency detected\n [  776.656167] 6.18.0for-upstream_debug_94e244d9ccab #1 Not tainted\n [  776.657114] ------------------------------------------------------\n [  776.658087] devlink/14824 is trying to acquire lock:\n [  776.658879] ffff88811170c800 (&mm->mmap_lock){++++}-{4:4}, at: uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs]\n [  776.660479]\n [  776.660479] but task is already holding lock:\n [  776.661460] ffff888142d92b08 (&file->disassociation_lock){+.+.}-{4:4}, at: uverbs_user_mmap_disassociate+0x39/0x780 [ib_uverbs]\n [  776.663177]\n [  776.663177] which lock already depends on the new lock.\n [  776.663177]\n [  776.664525]\n [  776.664525] the existing dependency chain (in reverse order) is:\n [  776.665724]\n [  776.665724] -> #2 (&file->disassociation_lock){+.+.}-{4:4}:\n [  776.666887]        __mutex_lock+0x16d/0x2330\n [  776.667633]        rdma_umap_open+0x129/0x280 [ib_uverbs]\n [  776.668489]        dup_mmap+0xa40/0x1790\n [  776.669170]        copy_process+0x5dd2/0x6170\n [  776.669933]        kernel_clone+0xb6/0x610\n [  776.670636]        __do_sys_clone+0xb5/0xf0\n [  776.671354]        do_syscall_64+0x70/0x12e0\n [  776.672083]        entry_SYSCALL_64_after_hwframe+0x4b/0x53\n [  776.672940]\n [  776.672940] -> #1 (&mm->mmap_lock/1){+.+.}-{4:4}:\n [  776.673985]        down_write_nested+0x90/0x1e0\n [  776.674751]        dup_mmap+0x201/0x1790\n [  776.675448]        copy_process+0x5dd2/0x6170\n [  776.676180]        kernel_clone+0xb6/0x610\n [  776.676904]        __do_sys_clone+0xb5/0xf0\n [  776.677615]        do_syscall_64+0x70/0x12e0\n [  776.678351]        entry_SYSCALL_64_after_hwframe+0x4b/0x53\n [  776.679239]\n [  776.679239] -> #0 (&mm->mmap_lock){++++}-{4:4}:\n [  776.680253]        __lock_acquire+0x18c6/0x2ec0\n [  776.681018]        lock_acquire+0x10e/0x2e0\n [  776.681742]        down_read+0x95/0x430\n [  776.682395]        uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs]\n [  776.683436]        uverbs_destroy_ufile_hw+0x1ae/0x270 [ib_uverbs]\n [  776.684416]        ib_uverbs_remove_one+0x22b/0x420 [ib_uverbs]\n [  776.685371]        remove_client_context+0xa6/0xf0 [ib_core]\n [  776.686342]        disable_device+0x12b/0x240 [ib_core]\n [  776.687249]        __ib_unregister_device+0x269/0x460 [ib_core]\n [  776.688233]        ib_unregister_device+0x21/0x30 [ib_core]\n [  776.689140]        mlx5r_remove+0xd0/0x170 [mlx5_ib]\n [  776.689999]        device_release_driver_internal+0x3b2/0x5\n---truncated---","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-14 14:17:54","updated_at":"2026-10-19 10:18:49"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/426f54f20b79c5b164a0472ad3f6ba36afcd08c6","name":"https://git.kernel.org/stable/c/426f54f20b79c5b164a0472ad3f6ba36afcd08c6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","name":"https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98431","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98431","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 51976c6cd786151b6a1bdf8b8b3334beac0ba99c 426f54f20b79c5b164a0472ad3f6ba36afcd08c6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 51976c6cd786151b6a1bdf8b8b3334beac0ba99c a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0598914a950ddfa694f410e482453cdbb9265515 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 86092a4e46d161d24f8106df082e24b8efe87382 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.11.11 6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.12.2 6.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.13","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.8 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/core/rdma_core.c","drivers/infiniband/core/uverbs_main.c","include/rdma/uverbs_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"426f54f20b79c5b164a0472ad3f6ba36afcd08c6","status":"affected","version":"51976c6cd786151b6a1bdf8b8b3334beac0ba99c","versionType":"git"},{"lessThan":"a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236","status":"affected","version":"51976c6cd786151b6a1bdf8b8b3334beac0ba99c","versionType":"git"},{"status":"affected","version":"0598914a950ddfa694f410e482453cdbb9265515","versionType":"git"},{"status":"affected","version":"86092a4e46d161d24f8106df082e24b8efe87382","versionType":"git"},{"lessThan":"6.12","status":"affected","version":"6.11.11","versionType":"semver"},{"lessThan":"6.13","status":"affected","version":"6.12.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/core/rdma_core.c","drivers/infiniband/core/uverbs_main.c","include/rdma/uverbs_types.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.8","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency\n\nCommit 51976c6cd786 (\"RDMA/core: Provide rdma_user_mmap_disassociate()\nto disassociate mmap pages\") introduced disassociation_lock to protect\nnew mmap registrations against uverbs_user_mmap_disassociate(), but\ncreated an ABBA deadlock:\n\n  Thread A (mmap / fork):\n    mmap_lock -> disassociation_lock\n\n  Thread B (disassociate):\n    disassociation_lock -> mmap_lock\n\nFix by removing disassociation_lock entirely and using the pre-existing\nhw_destroy_rwsem instead. hw_destroy_rwsem already provides the same\nprotection: rdma_umap_open() and ib_uverbs_mmap() both use\ndown_read_trylock() before registering a new VMA, so holding hw_destroy_rwsem\nin uverbs_user_mmap_disassociate() is sufficient to block new registrations.\ntrylock is used in both mmap paths (not blocking down_read) because\nmmap_lock is already held on entry, and uverbs_user_mmap_disassociate()\nacquires mmap_lock internally — a blocking read would recreate the same\ndeadlock.\n\nThe only caller that was not taking hw_destroy_rwsem for write was\nrdma_user_mmap_disassociate(). Fix it to take the rwsem per-ufile while\niterating under lists_mutex.  This is safe because ib_uverbs_close()\nreleases hw_destroy_rwsem entirely before acquiring lists_mutex, so the\ntwo locks are never held simultaneously.\n\nlockdep warning:\n\n [  776.654252] ======================================================\n [  776.655214] WARNING: possible circular locking dependency detected\n [  776.656167] 6.18.0for-upstream_debug_94e244d9ccab #1 Not tainted\n [  776.657114] ------------------------------------------------------\n [  776.658087] devlink/14824 is trying to acquire lock:\n [  776.658879] ffff88811170c800 (&mm->mmap_lock){++++}-{4:4}, at: uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs]\n [  776.660479]\n [  776.660479] but task is already holding lock:\n [  776.661460] ffff888142d92b08 (&file->disassociation_lock){+.+.}-{4:4}, at: uverbs_user_mmap_disassociate+0x39/0x780 [ib_uverbs]\n [  776.663177]\n [  776.663177] which lock already depends on the new lock.\n [  776.663177]\n [  776.664525]\n [  776.664525] the existing dependency chain (in reverse order) is:\n [  776.665724]\n [  776.665724] -> #2 (&file->disassociation_lock){+.+.}-{4:4}:\n [  776.666887]        __mutex_lock+0x16d/0x2330\n [  776.667633]        rdma_umap_open+0x129/0x280 [ib_uverbs]\n [  776.668489]        dup_mmap+0xa40/0x1790\n [  776.669170]        copy_process+0x5dd2/0x6170\n [  776.669933]        kernel_clone+0xb6/0x610\n [  776.670636]        __do_sys_clone+0xb5/0xf0\n [  776.671354]        do_syscall_64+0x70/0x12e0\n [  776.672083]        entry_SYSCALL_64_after_hwframe+0x4b/0x53\n [  776.672940]\n [  776.672940] -> #1 (&mm->mmap_lock/1){+.+.}-{4:4}:\n [  776.673985]        down_write_nested+0x90/0x1e0\n [  776.674751]        dup_mmap+0x201/0x1790\n [  776.675448]        copy_process+0x5dd2/0x6170\n [  776.676180]        kernel_clone+0xb6/0x610\n [  776.676904]        __do_sys_clone+0xb5/0xf0\n [  776.677615]        do_syscall_64+0x70/0x12e0\n [  776.678351]        entry_SYSCALL_64_after_hwframe+0x4b/0x53\n [  776.679239]\n [  776.679239] -> #0 (&mm->mmap_lock){++++}-{4:4}:\n [  776.680253]        __lock_acquire+0x18c6/0x2ec0\n [  776.681018]        lock_acquire+0x10e/0x2e0\n [  776.681742]        down_read+0x95/0x430\n [  776.682395]        uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs]\n [  776.683436]        uverbs_destroy_ufile_hw+0x1ae/0x270 [ib_uverbs]\n [  776.684416]        ib_uverbs_remove_one+0x22b/0x420 [ib_uverbs]\n [  776.685371]        remove_client_context+0xa6/0xf0 [ib_core]\n [  776.686342]        disable_device+0x12b/0x240 [ib_core]\n [  776.687249]        __ib_unregister_device+0x269/0x460 [ib_core]\n [  776.688233]        ib_unregister_device+0x21/0x30 [ib_core]\n [  776.689140]        mlx5r_remove+0xd0/0x170 [mlx5_ib]\n [  776.689999]        device_release_driver_internal+0x3b2/0x5\n---truncated---"}],"providerMetadata":{"dateUpdated":"2026-10-19T09:19:26.316Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/426f54f20b79c5b164a0472ad3f6ba36afcd08c6"},{"url":"https://git.kernel.org/stable/c/a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236"}],"title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98431","datePublished":"2026-10-14T13:27:56.162Z","dateReserved":"2026-09-25T10:25:14.348Z","dateUpdated":"2026-10-19T09:19:26.316Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-14 14:17:54","lastModifiedDate":"2026-10-19 10:18:49","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98431","Ordinal":"1","Title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependen","CVE":"CVE-2026-98431","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98431","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency\n\nCommit 51976c6cd786 (\"RDMA/core: Provide rdma_user_mmap_disassociate()\nto disassociate mmap pages\") introduced disassociation_lock to protect\nnew mmap registrations against uverbs_user_mmap_disassociate(), but\ncreated an ABBA deadlock:\n\n  Thread A (mmap / fork):\n    mmap_lock -> disassociation_lock\n\n  Thread B (disassociate):\n    disassociation_lock -> mmap_lock\n\nFix by removing disassociation_lock entirely and using the pre-existing\nhw_destroy_rwsem instead. hw_destroy_rwsem already provides the same\nprotection: rdma_umap_open() and ib_uverbs_mmap() both use\ndown_read_trylock() before registering a new VMA, so holding hw_destroy_rwsem\nin uverbs_user_mmap_disassociate() is sufficient to block new registrations.\ntrylock is used in both mmap paths (not blocking down_read) because\nmmap_lock is already held on entry, and uverbs_user_mmap_disassociate()\nacquires mmap_lock internally — a blocking read would recreate the same\ndeadlock.\n\nThe only caller that was not taking hw_destroy_rwsem for write was\nrdma_user_mmap_disassociate(). Fix it to take the rwsem per-ufile while\niterating under lists_mutex.  This is safe because ib_uverbs_close()\nreleases hw_destroy_rwsem entirely before acquiring lists_mutex, so the\ntwo locks are never held simultaneously.\n\nlockdep warning:\n\n [  776.654252] ======================================================\n [  776.655214] WARNING: possible circular locking dependency detected\n [  776.656167] 6.18.0for-upstream_debug_94e244d9ccab #1 Not tainted\n [  776.657114] ------------------------------------------------------\n [  776.658087] devlink/14824 is trying to acquire lock:\n [  776.658879] ffff88811170c800 (&mm->mmap_lock){++++}-{4:4}, at: uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs]\n [  776.660479]\n [  776.660479] but task is already holding lock:\n [  776.661460] ffff888142d92b08 (&file->disassociation_lock){+.+.}-{4:4}, at: uverbs_user_mmap_disassociate+0x39/0x780 [ib_uverbs]\n [  776.663177]\n [  776.663177] which lock already depends on the new lock.\n [  776.663177]\n [  776.664525]\n [  776.664525] the existing dependency chain (in reverse order) is:\n [  776.665724]\n [  776.665724] -> #2 (&file->disassociation_lock){+.+.}-{4:4}:\n [  776.666887]        __mutex_lock+0x16d/0x2330\n [  776.667633]        rdma_umap_open+0x129/0x280 [ib_uverbs]\n [  776.668489]        dup_mmap+0xa40/0x1790\n [  776.669170]        copy_process+0x5dd2/0x6170\n [  776.669933]        kernel_clone+0xb6/0x610\n [  776.670636]        __do_sys_clone+0xb5/0xf0\n [  776.671354]        do_syscall_64+0x70/0x12e0\n [  776.672083]        entry_SYSCALL_64_after_hwframe+0x4b/0x53\n [  776.672940]\n [  776.672940] -> #1 (&mm->mmap_lock/1){+.+.}-{4:4}:\n [  776.673985]        down_write_nested+0x90/0x1e0\n [  776.674751]        dup_mmap+0x201/0x1790\n [  776.675448]        copy_process+0x5dd2/0x6170\n [  776.676180]        kernel_clone+0xb6/0x610\n [  776.676904]        __do_sys_clone+0xb5/0xf0\n [  776.677615]        do_syscall_64+0x70/0x12e0\n [  776.678351]        entry_SYSCALL_64_after_hwframe+0x4b/0x53\n [  776.679239]\n [  776.679239] -> #0 (&mm->mmap_lock){++++}-{4:4}:\n [  776.680253]        __lock_acquire+0x18c6/0x2ec0\n [  776.681018]        lock_acquire+0x10e/0x2e0\n [  776.681742]        down_read+0x95/0x430\n [  776.682395]        uverbs_user_mmap_disassociate+0x168/0x780 [ib_uverbs]\n [  776.683436]        uverbs_destroy_ufile_hw+0x1ae/0x270 [ib_uverbs]\n [  776.684416]        ib_uverbs_remove_one+0x22b/0x420 [ib_uverbs]\n [  776.685371]        remove_client_context+0xa6/0xf0 [ib_core]\n [  776.686342]        disable_device+0x12b/0x240 [ib_core]\n [  776.687249]        __ib_unregister_device+0x269/0x460 [ib_core]\n [  776.688233]        ib_unregister_device+0x21/0x30 [ib_core]\n [  776.689140]        mlx5r_remove+0xd0/0x170 [mlx5_ib]\n [  776.689999]        device_release_driver_internal+0x3b2/0x5\n---truncated---","Type":"Description","Title":"RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependen"}]}}}