CVE-2026-99212

{"id": "CVE-2026-99212", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea", "lessThan": "664fd3205cbec71ac52c005ee705cd917bb6fb1a", "versionType": "git"}, {"status": "affected", "version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea", "lessThan": "b8f141f65885810e24fc23b8a71692db62d535bf", "versionType": "git"}, {"status": "affected", "version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea", "lessThan": "e677eda15df7d5ce256654343418043c7ffd6f9b", "versionType": "git"}, {"status": "affected", "version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea", "lessThan": "92143c5d80382588d5a3047a4f14023ee9ef6485", "versionType": "git"}, {"status": "affected", "version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea", "lessThan": "a7c7d0ff876377fea7ae876a28d6df8d9349df57", "versionType": "git"}, {"status": "affected", "version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea", "lessThan": "91ece3efa064f0b3b3c67b9b045d9eeb4a034e43", "versionType": "git"}, {"status": "affected", "version": "55b7ed0b582f9ff4bf3b9b44969cddda8c6763ea", "lessThan": "98d446b7c013254a8a7b49720557676a3a851fde", "versionType": "git"}], "programFiles": ["net/rds/rdma_transport.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.30"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.30", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.224", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.161", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.115", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.59", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.13", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/rds/rdma_transport.c"], "defaultStatus": "affected"}]}], "published": "2026-10-28T11:17:42.650", "references": [{"url": "https://git.kernel.org/stable/c/664fd3205cbec71ac52c005ee705cd917bb6fb1a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/91ece3efa064f0b3b3c67b9b045d9eeb4a034e43", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/92143c5d80382588d5a3047a4f14023ee9ef6485", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/98d446b7c013254a8a7b49720557676a3a851fde", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a7c7d0ff876377fea7ae876a28d6df8d9349df57", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b8f141f65885810e24fc23b8a71692db62d535bf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e677eda15df7d5ce256654343418043c7ffd6f9b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on. That id is ic->i_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect() and\nrdma_destroy_id() on it.\n\nThe ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect()\nforces a zero return while ic->i_cm_id == cm_id, as the comment there\nexplains. Do the same here - drop the connection and return 0 - so\nthe id stays RDS's to destroy from the shutdown, and the reconnect\ngets a fresh one."}], "lastModified": "2026-10-31T13:17:59.453", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}