VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-97954: Linux kernel · net/rds: fix tcp stream corruption with large pages

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f4649a716be20ef9272f97a166dea1825ba5b554 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f4649a716be20ef9272f97a166dea1825ba5b554, ef3565a418b8309589fe9b5df098a892c9146b06, ee74a4b42e3a2f9635ba376be9e58311322eebe4 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 7875e18e09961d29f30424c5e2e48e704dc3789b, < f4649a716be20ef9272f97a166dea1825ba5b554	Fixed in f4649a716be20ef9272f97a166dea1825ba5b554
LinuxLinux	Affected ≥ 7875e18e09961d29f30424c5e2e48e704dc3789b, < ef3565a418b8309589fe9b5df098a892c9146b06	Fixed in ef3565a418b8309589fe9b5df098a892c9146b06
LinuxLinux	Affected ≥ 7875e18e09961d29f30424c5e2e48e704dc3789b, < ee74a4b42e3a2f9635ba376be9e58311322eebe4	Fixed in ee74a4b42e3a2f9635ba376be9e58311322eebe4
LinuxLinux	Affected ≥ 7875e18e09961d29f30424c5e2e48e704dc3789b, < 3230961a72b312d0e47101d1428084d0a02bff52	Fixed in 3230961a72b312d0e47101d1428084d0a02bff52
LinuxLinux	Affected ≥ 7875e18e09961d29f30424c5e2e48e704dc3789b, < 348492de88bc6ea06b6f3dd544a7a00d908a807b	Fixed in 348492de88bc6ea06b6f3dd544a7a00d908a807b
LinuxLinux	Affected ≥ 7875e18e09961d29f30424c5e2e48e704dc3789b, < 8cbfeb54bf781d9693778aaba133bb58c0285332	Fixed in 8cbfeb54bf781d9693778aaba133bb58c0285332

AI-suggested

A fix is available and has been applied in the Linux kernel versions identified by the fixed commit hashes. Users should update their Linux kernel to a version including these fixes to resolve the TCP stream corruption issue. No additional mitigation steps are necessary once the patch is applied.

Description

A vulnerability in the Linux kernel's RDS TCP implementation causes TCP stream corruption on systems with large memory pages. The issue arises because the function rds_message_map_pages() assigns PAGE_SIZE bytes to each scatterlist entry without accounting for partial pages, leading to out-of-bounds memory mapping when PAGE_SIZE exceeds the size of the RDS congestion map. This results in corrupted TCP streams. The flaw has been fixed by limiting the final scatterlist mapping to the remaining bytes, enabling proper operation on systems with 16K or larger page sizes.

Impact

The vulnerability causes corruption of TCP streams used by RDS on Linux systems with large page sizes (greater than 8192 bytes). This corruption can disrupt communication over RDS-TCP, potentially leading to data integrity issues or communication failures in applications relying on RDS. Systems with the common 4K page size are unaffected. There is no indication of exploitation in the wild.

Summary

CVE-2026-97954 addresses a flaw in the Linux kernel's Reliable Datagram Sockets (RDS) TCP implementation where rds_message_map_pages() incorrectly assigns PAGE_SIZE bytes to scatterlist entries even when the total length ends with a partial page. On systems with PAGE_SIZE greater than 8192 bytes, this causes the scatterlist to map beyond the end of the RDS congestion map, corrupting the TCP stream by injecting extra bytes interpreted as RDS message headers. The fix restricts the final scatterlist entry to the exact remaining byte count, resolving the corruption and allowing RDS-TCP to function correctly on systems with large page sizes such as 16K.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:21 UTC

Technical details

References

Community reviews

Related threats