In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is… (CVE-2026-53355)
In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released. When rds_ib_setup_qp() fails after allocating i_sends but before allocating i_recvs, the sends_out path frees i_sends without clearing the pointer. A later shutdown pass can still treat that stale pointer as a live send ring allocation. Clear i_sends after vfree() in the error unwind path so the existing shutdown logic continues to use the correct ownership state.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's RDS IB connection teardown occurs because the sends_out path frees the i_sends resource without clearing its pointer after a failure in rds_ib_setup_qp(). This stale pointer can then be misinterpreted as a valid allocation during repeated shutdown attempts, causing improper resource management. The fix involves clearing the i_sends pointer after freeing it to ensure the shutdown logic correctly recognizes resource ownership state.
Potential Impact
The vulnerability has a critical impact with high confidentiality, integrity, and availability consequences as indicated by the CVSS vector. Improper handling of freed pointers can lead to use-after-free conditions, potentially causing kernel crashes, data corruption, or privilege escalation within the affected Linux kernel networking subsystem.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to clear the i_sends pointer after freeing it in the error unwind path. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the current remediation guidance.
In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is… (CVE-2026-53355)
Description
In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released. When rds_ib_setup_qp() fails after allocating i_sends but before allocating i_recvs, the sends_out path frees i_sends without clearing the pointer. A later shutdown pass can still treat that stale pointer as a live send ring allocation. Clear i_sends after vfree() in the error unwind path so the existing shutdown logic continues to use the correct ownership state.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's RDS IB connection teardown occurs because the sends_out path frees the i_sends resource without clearing its pointer after a failure in rds_ib_setup_qp(). This stale pointer can then be misinterpreted as a valid allocation during repeated shutdown attempts, causing improper resource management. The fix involves clearing the i_sends pointer after freeing it to ensure the shutdown logic correctly recognizes resource ownership state.
Potential Impact
The vulnerability has a critical impact with high confidentiality, integrity, and availability consequences as indicated by the CVSS vector. Improper handling of freed pointers can lead to use-after-free conditions, potentially causing kernel crashes, data corruption, or privilege escalation within the affected Linux kernel networking subsystem.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to clear the i_sends pointer after freeing it in the error unwind path. Users should apply the official Linux kernel updates that include this patch to remediate the vulnerability. Patch status is not explicitly confirmed in the provided data; therefore, check the Linux kernel vendor advisory for the current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3hv8-6fp5-2gcr
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53355"]
- Ecosystems
- []
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a5ba7ec44ab8fbf7c84ac66
Added to database: 07/18/2026, 16:21:00 UTC
Last enriched: 07/18/2026, 16:29:47 UTC
Last updated: 07/18/2026, 19:25:08 UTC
Views: 23
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.