In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with… (CVE-2026-98560)

The vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem arises from __rds_conn_create() computing the number of paths (npaths) based on the caller's transport before determining if the connection should use the loopback transport. This leads to allocation of multiple workqueues for paths that are not properly initialized or destroyed, as rds_conn_destroy() and rds_conn_path_destroy() only handle the loopback transport's single path correctly. Consequently, memory allocated for unused paths is leaked during connection teardown, particularly on netns teardown or module unload for local TCP RDS connections. The fix recomputes npaths after finalizing the transport to ensure consistent sizing and proper cleanup of all paths.

The vulnerability causes memory leaks in the kernel when RDS connections over TCP loopback are created and destroyed, especially during network namespace teardown or module unload. This can lead to resource exhaustion over time if many such connections are created and destroyed, potentially impacting system stability or performance. There is no indication of direct code execution or privilege escalation from this issue.

A fix has been implemented to recompute the number of paths after the transport is finalized, ensuring that connection creation and destruction handle the same set of paths and properly free all allocated resources. Users should apply the official Linux kernel update that includes this fix. No additional mitigation is indicated.