---
id: "CVE-2026-98560"
kind: "vulnerability"
aliases: ["CVE-2026-98560"]
title: "Linux kernel RDS: connection teardown leaks workqueues to local addresses"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kernel", "linux", "rds", "runtime", "self-hosted"]
not_affected_if: ["rds-module-not-loaded"]
published_at: "2026-10-18T16:17:08+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:23:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98560", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel RDS: connection teardown leaks workqueues to local addresses

In the Linux RDS networking code, creating a connection to a local address allocates workqueues for paths the loopback transport never uses, and teardown drops the pointers to them. Each such connection leaks several workqueues on every network namespace teardown or module unload.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98560

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net/rds: size a connection's path set by the transport it ends up with

__rds_conn_create() computes npaths from the caller's transport before
it decides whether a connection to one of the host's own addresses is
to be handled by the loopback transport instead.  That substitution is
what an RDS/TCP socket sending to a local address gets, and after it
the path init loop still runs for the TCP transport's RDS_MPATH_WORKERS
paths and allocates an ordered workqueue for each, while
rds_loop_conn_alloc() only ever provides transport data for path 0.

rds_conn_destroy() sizes its teardown from c_trans, by then the
loopback transport, so it visits path 0 only - and
rds_conn_path_destroy() would skip the other paths anyway, since it
returns before destroy_workqueue() for a path without transport data.
kfree(c_path) then drops the last pointers to seven workqueues.  That
repeats for every such connection, on every netns teardown or module
unload, and every distinct local destination address is a separate
connection.

Recompute npaths once the transport is final, so that creation and
destruction agree on the set of paths.  The c_path array stays sized
for the caller's transport; the unused entries are freed with it.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_