CVE-2026-98352: Linux kernel · RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
Affects Linux kernelSource GCVE Database
Not known to be exploited.
Data as of 28 Oct 2026, 01:28 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Ubuntu 26.04 LTSlinuxpkg:deb/ubuntu/linux?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-awspkg:deb/ubuntu/linux-aws?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azurepkg:deb/ubuntu/linux-azure?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-azure-fdepkg:deb/ubuntu/linux-azure-fde?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gcppkg:deb/ubuntu/linux-gcp?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Ubuntu 26.04 LTSlinux-gkepkg:deb/ubuntu/linux-gke?arch=source&distro=resoluteOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted The client borrows shared CQ credits in the ADDR_RESOLVED handler via ib_cq_pool_get(), before the peer is connected. create_cm() can return -ERESTARTSYS from wait_event_interruptible_timeout() without destroying the CM ID. The init_conns() and stop-and-destroy paths then call destroy_con_cq_qp() while cq is still NULL (no PUT) and only afterwards rdma_destroy_id(). CMA serializes the handler against rdma_destroy_id() with handler_mutex, but that does not order the GET against destroy_con_cq_qp(). If ADDR_RESOLVED has already passed the DESTROYING check, it can take con_mutex, GET credits, and then lose the con to kfree. Device unregister later hits WARN_ON(cq->cqe_used) in ib_cq_pool_cleanup(). Set a per-connection flag under con_mutex before CQ/QP teardown so a racing ADDR_RESOLVED cannot borrow credits after teardown has begun.
References
- ubuntu.com/security/CVE-2026-98352 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-98352 (opens in a new tab)
- git.kernel.org/linus/2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda (opens in a new tab)
- git.kernel.org/stable/c/2ae16aaa78b5edc6e6d0904c84fd9cdfb762bcda (opens in a new tab)
- git.kernel.org/stable/c/31024e158b45358370a0a14ed96589e6aa62d6cb (opens in a new tab)
- git.kernel.org/stable/c/6f8020fe7465f49e234a576c04e415e9d08c7878 (opens in a new tab)
- git.kernel.org/stable/c/74c4ed55e61f1b65ddbebc5b635d136461a1c3da (opens in a new tab)
- git.kernel.org/stable/c/8f253d5893f991742464b9e7203c43fc08d0aa11 (opens in a new tab)
- git.kernel.org/stable/c/a82cca40139d9fcae8208901856bd5bb4051f097 (opens in a new tab)
- git.kernel.org/stable/c/bf88ac4867050112a6c819c8d1a7209bf48ef427 (opens in a new tab)