CVE-2026-98431

A low impact denial-of-service flaw was found in the Linux kernel's RDMA userspace verbs (uverbs) subsystem. The commit that introduced rdma_user_mmap_disassociate() created an ABBA circular locking dependency between a process's mmap_lock and the per-file disassociation_lock: a thread performing an mmap or fork on an RDMA device file takes mmap_lock and then disassociation_lock, while a thread disassociating an RDMA device (for example during device removal or a devlink reload) takes disassociation_lock and then mmap_lock. A local user able to race memory-mapping operations on RDMA device files against RDMA device disassociation can trigger this deadlock, resulting in a kernel thread or system hang. Confidentiality and integrity are not affected. The vulnerable code is present in Red Hat Enterprise Linux 9 (from the 9.6 stream onward), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9 kernels shipped with OpenShift Container Platform 4.19 and later, because the introducing commit was backported into those streams. Earlier Red Hat Enterprise Linux 6, 7, 8, 9.2, 9.4, and 10.0 kernels and their real-time variants, and the OpenShift Container Platform 4.12 through 4.18 CoreOS images, do not contain the vulnerable code and are therefore not affected. Although the Red Hat CVSS 3.1 base score for this flaw is 5.5 (Moderate), Red Hat rates its overall impact as low, because triggering the deadlock requires winning a race between a privileged device-disassociation operation (such as a devlink reload or device unregistration, which needs administrative capabilities) and local memory-mapping activity, and the consequence is limited to availability. Fixes for the affected streams are deferred to a future planned update; the residual risk is a local denial of service restricted to systems that use RDMA hardware and run RDMA userspace workloads.