{"id":"CVE-2026-98560","kind":"vulnerability","aliases":["CVE-2026-98560"],"related":[],"title":"Linux kernel RDS: connection teardown leaks workqueues to local addresses","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: size a connection's path set by the transport it ends up with\n\n__rds_conn_create() computes npaths from the caller's transport before\nit decides whether a connection to one of the host's own addresses is\nto be handled by the loopback transport instead.  That substitution is\nwhat an RDS/TCP socket sending to a local address gets, and after it\nthe path init loop still runs for the TCP transport's RDS_MPATH_WORKERS\npaths and allocates an ordered workqueue for each, while\nrds_loop_conn_alloc() only ever provides transport data for path 0.\n\nrds_conn_destroy() sizes its teardown from c_trans, by then the\nloopback transport, so it visits path 0 only - and\nrds_conn_path_destroy() would skip the other paths anyway, since it\nreturns before destroy_workqueue() for a path without transport data.\nkfree(c_path) then drops the last pointers to seven workqueues.  That\nrepeats for every such connection, on every netns teardown or module\nunload, and every distinct local destination address is a separate\nconnection.\n\nRecompute npaths once the transport is final, so that creation and\ndestruction agree on the set of paths.  The c_path array stays sized\nfor the caller's transport; the unused entries are freed with it.","summary":"In the Linux RDS networking code, creating a connection to a local address allocates workqueues for paths the loopback transport never uses, and teardown drops the pointers to them. Each such connection leaks several workqueues on every network namespace teardown or module unload.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","rds","runtime","self-hosted"],"not_affected_if":["rds-module-not-loaded"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:22+00:00","updated_at":"2026-10-25T05:23:22+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:23:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel RDS: connection teardown leaks workqueues to local addresses","impact":"low","summary":"In the Linux RDS networking code, creating a connection to a local address allocates workqueues for paths the loopback transport never uses, and teardown drops the pointers to them. Each such connection leaks several workqueues on every network namespace teardown or module unload.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","rds","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"resource leak: kernel workqueues accumulate, memory is not returned","analyst_note":"Check the kernel.org stable commit for this fix and the fixed kernel versions; the sources give no version ranges.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["rds-module-not-loaded"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000547,"input_tokens":3640,"output_tokens":365,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98560':13A,16A '0':174C,193C 'address':10A,36B,114C,135C,247C 'agre':264C 'alloc':37B,156C,166C 'anyway':205C 'array':273C 'c':182C,219C,271C 'caller':98C,278C 'code':29B 'comput':94C 'conn':92C,165C,176C,197C 'connect':4A,32B,55B,80C,106C,234C,251C 'creat':30B,93C 'creation':261C 'cve':11A,14A 'data':171C,217C 'decid':103C 'destin':246C 'destroy':177C,199C,210C 'destruct':263C 'distinct':244C 'drop':48B,222C 'end':88C 'entri':283C 'ever':168C 'everi':60B,232C,236C,243C 'final':258C 'follow':72C 'freed':285C 'get':136C 'handl':118C 'host':23B,111C 'init':142C 'instead':123C 'kernel':2A,17B,70C 'kfree':218C 'last':224C 'leak':6A,56B 'linux':1A,18B,26B,69C 'local':9A,35B,134C,245C 'loop':143C,164C 'loopback':42B,121C,187C 'modul':65B,240C 'mpath':152C 'namespac':62B 'net/rds':77C 'netn':237C 'network':28B,61B 'never':44B 'npath':95C,253C 'one':108C 'order':158C 'path':40B,82C,141C,154C,173C,192C,198C,204C,214C,220C,269C,272C 'pointer':50B,225C 'provid':169C 'rds':3A,19B,27B,91C,151C,163C,175C,196C 'rds/tcp':129C 'recomput':252C 'repeat':230C 'resolv':76C 'return':208C 'run':145C 'runtim':20B 'self':22B 'self-host':21B 'send':131C 'separ':250C 'set':83C,267C 'seven':227C 'sever':57B 'sinc':206C 'size':78C,178C,275C 'skip':201C 'socket':130C 'stay':274C 'still':144C 'substitut':125C 'tcp':148C 'teardown':5A,47B,63B,180C,238C 'tran':183C 'transport':43B,86C,100C,122C,149C,170C,188C,216C,256C,280C 'unload':66B,241C 'unus':282C 'use':45B 'visit':191C 'vulner':73C 'whether':104C 'without':215C 'worker':153C 'workqueu':7A,38B,58B,159C,211C,228C 'would':200C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98560","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98560","severity":null,"published_at":"2026-10-18T16:17:08+00:00","modified_at":"2026-10-19T10:19:12+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}