CVE-2026-98359
Description
A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem. When an asynchronous RDMA port query retrieves link speed settings, the kernel fails to verify whether the associated network device is being unregistered before invoking its operations. A local user could exploit this condition to access uninitialized or partially dismantled device structures, resulting in a kernel crash and Denial of Service (DoS).
Statement
A flaw was found in the Linux kernel's RDMA core subsystem that affects the kernel and kernel-rt packages in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform. The ib_get_eth_speed() function invokes the ethtool callback of a network device returned by ib_device_get_netdev() without first verifying the device's registration state. Although the retrieved reference keeps struct net_device allocated, it does not guarantee the device remains operational, so an asynchronous RDMA port query can race with network device unregistration and call into a netdev after NETDEV_UNREGISTER and ndo_uninit have completed. A local user could exploit this race condition to access uninitialized or partially dismantled device structures, resulting in a kernel crash and denial of service; confidentiality and integrity are not affected. The Red Hat severity of Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) differs from the upstream CVEORG rating of 7.0 (Important) because Red Hat assesses the impact of this flaw as limited to availability. The fix is currently deferred for the affected Red Hat products, so it will be addressed in a future scheduled update rather than an immediate erratum; the residual risk is limited to a local denial of service that requires issuing RDMA port queries while a network device is concurrently being unregistered.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
