Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-98253

RDMA/ucma: Serialize join and leave on copy_to_user failure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copy_to_user failure rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s the CMA multicast at the head of id_priv->mc_list. rdma_leave_multicast() matches only by sockaddr and destroys the first hit. ucma_process_join() used to drop ctx->mutex after a successful join and retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucma_multicast that the first thread frees. Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and, on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mc_list, and a leave-by-addr would destroy an earlier successful join.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 60d613b39e8d0c9f3b526e9c96445422b4562d76 to < 29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9affected
  • fe454dc31e84f8c14cb8942fcb61666c9f40745b to < 52172e11bd074ccaded21740ffeb67123f01dd00affected
  • fe454dc31e84f8c14cb8942fcb61666c9f40745b to < 01e29d0d78a8f66f221625720a04939eef5ec1f6affected
  • fe454dc31e84f8c14cb8942fcb61666c9f40745b to < ae805d204cf1f15b87d1bf3529b4c649f3519420affected
  • fe454dc31e84f8c14cb8942fcb61666c9f40745b to < 43c4e24bd10370fc976f6220518049ce71419399affected
  • fe454dc31e84f8c14cb8942fcb61666c9f40745b to < 01cbdb724c584d7772fd25af2e4dfdf8527ce0d5affected
  • fe454dc31e84f8c14cb8942fcb61666c9f40745b to < 83610ee5e498fa5bfcb80031d2b959baea276bf6affected
  • fe454dc31e84f8c14cb8942fcb61666c9f40745b to < 662ade4de9ff5eceb0820a9f8e9fac70ba6a815baffected
  • a3262b3884dd67b4c5632ce7cdf9cff9d1a575d4affected
  • 5.10.20 to < 5.10.271affected
  • 5.11.3 to < 5.12affected

Linux Linux

Default version status: affected

  • 5.12affected
  • 0 to < 5.12unaffected
  • 5.10.271 to ≤ 5.10.*unaffected
  • 5.15.222 to ≤ 5.15.*unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.54 to ≤ 6.18.*unaffected
  • 7.2.8 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References