CVE-2026-98069
Description
A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. A race condition between active data transmission and connection teardown can lead to a Denial of Service (DoS) via a kernel crash. A local user could exploit this flaw by generating network traffic while terminating a connection, causing concurrent access to resetting transport resources.
Statement
A moderate-impact vulnerability was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. During connection teardown, rds_conn_shutdown() only waited for the RDS_IN_XMIT and RDS_RECV_REFILL fastpath bits to be sampled clear rather than acquiring them, so the transmit or receive-refill path could re-acquire a bit immediately afterwards and run concurrently with the teardown on weakly ordered architectures, accessing transport rings and transmit state while they were being reset. A local user able to create RDS sockets could exploit this race by generating network traffic while terminating a connection, causing a kernel crash (for example a NULL pointer dereference or BUG_ON) and resulting in denial of service of the affected system. Red Hat assesses this flaw as moderate because exploitation requires local access, standard user privileges, and winning a narrow race window, which differs from the higher severity (8.1, network attack vector) assigned by the upstream CVE record. None of the Red Hat products currently listed in this flaw are affected, because the vulnerable code is not present in the shipped kernel builds; the only affected record is the out-of-support Red Hat Enterprise Linux 6 Extended Lifecycle Support stream.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 8.1 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Alter Execution Logic; Unexpected State
The main problem is that -- if a lock is overcome -- data could be altered in a bad state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
