VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-98072: Linux kernel · net/rds: use wq_has_sleeper() in release_in_xmit()

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in ed7ee0cd0e136d02f87f13181b1a89880463c7e9 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ed7ee0cd0e136d02f87f13181b1a89880463c7e9, a269795107f45adc95975a83324f8fef40bec4ce, a94b1dfc82454c5bc068e71c25393af674daf63b +13

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.10.214 <5.10.271 >=5.15.153 <5.15.222 >=6.1.83 <6.1.189 >=6.6.23 <6.6.158 >=4.19.311 <4.20 >=5.4.273 <5.5 >=6.7.11 <6.8 >=6.8.2 <6.9	Fixed in ed7ee0cd0e136d02f87f13181b1a89880463c7e9 a269795107f45adc95975a83324f8fef40bec4ce a94b1dfc82454c5bc068e71c25393af674daf63b 3764627b30a283e611e652c4a2bb8cdc74a75a99 6f552364d97cf4005c7a58f11c9f79e14e269865 6d0c8b7073913011459cf968cbbadd341e166bc3 6.9 6.8 6.6.158 6.1.189 5a806ed1eb46850ca4159a18b2a8c4b70f0c1341 5.15.222 5.10.271 5.5 4.20 3d401934b7edb3ccb07d982dabadd04c45ee307c
LinuxLinux	Affected =6.9	Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel versions 4.20, 5.5, 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.8, 6.9, and later. Users and administrators should upgrade to these fixed versions to resolve the issue. No additional mitigation is required beyond applying the official kernel updates.

Description

CVE-2026-98072 is a Linux kernel vulnerability in the net/rds subsystem where release_in_xmit() uses clear_bit_unlock() followed by waitqueue_active() without a proper memory barrier. This can cause a lost wake-up scenario where a shutdown worker thread remains blocked indefinitely on a wait queue, potentially leading to resource hang during connection teardown. The issue arises from a missing full memory barrier after clearing a bit, which was unintentionally dropped in a prior commit. The fix replaces waitqueue_active() with wq_has_sleeper(), which includes the necessary memory barrier to ensure proper wake-up behavior.

Impact

The impact is a potential indefinite blocking of shutdown worker threads in the net/rds subsystem during connection teardown due to lost wake-ups. This can cause resource hang or delay in connection shutdown processing. There is no indication of code execution or privilege escalation. The issue affects kernel stability and reliability in affected versions.

Summary

The vulnerability in Linux kernel's net/rds subsystem involves the release_in_xmit() function clearing a bit with clear_bit_unlock() and then checking waitqueue_active() to decide if a waiter needs waking. Because clear_bit_unlock() does not provide a full memory barrier after the bit clear, the releasing CPU may see the wait queue as empty while the waiting CPU still sees the bit set, causing the sleeper to never be woken. This lost wake-up can strand the shutdown worker on a single-threaded workqueue indefinitely, especially problematic during connection teardown. The root cause was a prior commit that folded clear_bit() and smp_mb__after_atomic() into clear_bit_unlock(), dropping the full barrier needed for wake-up checks. The fix uses wq_has_sleeper(), which combines waitqueue_active() with the required full memory barrier, restoring correct synchronization.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:51 UTC

Technical details

References

Community reviews

Related threats