{"id":"CVE-2026-99166","kind":"vulnerability","aliases":["CVE-2026-99166"],"related":[],"title":"Linux kernel: RDS listener on iWARP device crashes the kernel on connect","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix uninitialized trans dereference in CM event handler\n\nrds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA\ndevice is an InfiniBand CA (RDMA_NODE_IB_CA).  On any other device\ntype, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but\nthe event switch dereferences it: unconditionally in the\nRDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(),\nand (with a connection context) in the ROUTE_RESOLVED and\nESTABLISHED cases.\n\nAn RDS listener on an iWARP device therefore crashes the kernel as\nsoon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO\nthe wild load becomes a NULL dereference at offset 0xa0\n(&trans->cm_handle_connect) in the iw_cm_wq workqueue.\n\nGCC masks the bug in default builds by folding the uninitialized\nload into &rds_ib_transport; Clang-built kernels take the real\nuninitialized path and oops.\n\nThe active side can land on a non-IB device too: the id that\nrds_ib_conn_path_connect() creates is not restricted to a node type,\nso rdma_resolve_addr() binds it to whichever device serves the local\naddress, and an iWARP RNIC on the same netdev qualifies.  The crash\nthere is different: resolving a route on an iWARP id never fills in\ncm_id->route.path_rec, and the ROUTE_RESOLVED case writes\npath_rec[0].sl before it calls into the transport.\n\nThe iWARP transport was dropped long ago and IB is the only\ntransport left, so make that explicit: initialize trans to\n&rds_ib_transport at declaration, drop the conditional assignment,\nreject a connect request that arrives on a non-IB device, and drop a\nconnection whose address resolved to one instead of resolving a\nroute on it.  The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUEST\non purpose: a non-zero return from the handler makes rdma_cm destroy\nthe id the event was delivered on, which is right for the request's\nfreshly created id but would free a connection id that RDS still owns\nfor any other event.  On the active side the id stays ic->i_cm_id and\nthe connection's shutdown destroys it, so that case returns 0.\n\n[achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of\n bailing out for every event on a non-IB device, so that rdma_cm does\n not destroy connection ids RDS still tracks; drop a connection whose\n address resolved to a non-IB device before a route is resolved on it;\n changelog adjusted]","summary":"The Linux kernel RDS (Reliable Datagram Sockets) RDMA connection manager read an uninitialized transport pointer when the RDMA device was not InfiniBand, such as an iWARP RNIC like siw. A connect request arriving on such a device causes a kernel NULL dereference and crash.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iwarp","linux-kernel","rdma","rds","runtime","self-hosted"],"not_affected_if":["infiniband-only","rds-not-loaded"],"how_to_check":"- `uname -r` and compare against the kernel release that carries the fix in the NVD entry\n- Check whether the RDS module is loaded with `lsmod | grep rds`\n- Check for iWARP RDMA devices with `rdma link show` or `ibv_devices`","fix":"- Update the Linux kernel to a release that includes the upstream commit 'net: rds: fix uninitialized trans dereference in CM event handler'\n- Until patched, unload RDS with `modprobe -r rds_rdma rds` if RDS is not needed","status":"open","published_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:42+00:00","updated_at":"2026-10-28T11:35:42+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-28T11:35:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'net: rds: fix uninitialized trans dereference in CM event handler'\n- Until patched, unload RDS with `modprobe -r rds_rdma rds` if RDS is not needed","reach":"network","title":"Linux kernel: RDS listener on iWARP device crashes the kernel on connect","impact":"medium","summary":"The Linux kernel RDS (Reliable Datagram Sockets) RDMA connection manager read an uninitialized transport pointer when the RDMA device was not InfiniBand, such as an iWARP RNIC like siw. A connect request arriving on such a device causes a kernel NULL dereference and crash.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","rds","rdma","iwarp","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel crashes on a connect request, causing denial of service","analyst_note":"Sources give no CVSS, affected version range, or fixed kernel version; check the NVD entry and the upstream kernel commit for affected and fixed releases.","how_to_check":"- `uname -r` and compare against the kernel release that carries the fix in the NVD entry\n- Check whether the RDS module is loaded with `lsmod | grep rds`\n- Check for iWARP RDMA devices with `rdma link show` or `ibv_devices`","needs_analyst":true,"not_affected_if":["rds-not-loaded","infiniband-only"],"who_is_affected":"Systems that load the RDS module and run an RDS listener or RDS connections over RDMA devices, especially iWARP NICs such as siw or Clang-built kernels. Hosts without RDS in use, or running only InfiniBand, are less exposed; the sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000754,"input_tokens":4163,"output_tokens":676,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99166':15A,18A '0':306C,449C '0xa0':194C 'achend':450C 'activ':230C,429C 'addr':260C 'address':269C,361C,488C 'adjust':504C 'ago':320C 'arriv':61B,178C,349C 'assign':99C,343C 'bail':461C 'becom':188C 'bind':261C 'bug':208C 'build':211C 'built':220C 'ca':109C,113C 'call':310C 'case':143C,160C,302C,447C 'caus':66B 'changelog':503C 'clang':219C 'clang-built':218C 'cm':90C,95C,139C,146C,196C,202C,294C,378C,394C,436C,455C,475C 'cmn':98C 'condit':342C 'config':180C 'conn':246C 'connect':12A,37B,59B,141C,148C,152C,176C,198C,248C,346C,359C,380C,417C,440C,457C,479C,486C 'context':153C 'crash':8A,72B,169C,280C 'creat':249C,411C 'cve':13A,16A 'datagram':34B 'declar':339C 'default':210C 'deliv':401C 'derefer':70B,88C,133C,191C 'destroy':395C,443C,478C 'devic':7A,47B,65B,105C,117C,167C,239C,265C,355C,471C,495C 'differ':283C 'drop':318C,340C,357C,484C 'e.g':119C 'establish':159C 'event':91C,96C,131C,140C,379C,399C,426C,456C,465C 'everi':464C 'explicit':331C 'fill':292C 'fix':85C 'fold':213C 'follow':78C 'free':415C 'fresh':410C 'gcc':205C 'handl':147C,197C 'handler':92C,97C,391C 'host':28B 'ib':112C,238C,245C,322C,336C,354C,470C,494C 'ic':434C 'id':242C,290C,295C,397C,412C,418C,432C,437C,480C 'infiniband':50B,108C 'init':181C 'initi':332C 'instead':365C,459C 'iw':201C 'iwarp':6A,19B,54B,121C,166C,272C,289C,315C 'kernel':2A,10A,22B,31B,68B,76C,171C,221C 'land':233C 'left':327C 'like':56B 'limit':375C 'linux':1A,21B,30B,75C 'linux-kernel':20B 'listen':4A,163C 'load':187C,216C 'local':268C 'long':319C 'make':329C,392C 'manag':38B 'mask':206C 'net':83C 'netdev':277C 'never':291C 'node':111C,255C 'non':237C,353C,386C,469C,493C 'non-ib':236C,352C,468C,492C 'non-zero':385C 'null':69B,190C 'offset':193C 'one':364C 'oop':228C 'own':422C 'path':226C,247C,304C 'pointer':43B 'purpos':383C 'qualifi':278C 'rdma':23B,36B,46B,94C,104C,110C,138C,258C,377C,393C,454C,474C 'rds':3A,24B,32B,84C,93C,162C,244C,335C,420C,481C 'read':39B 'real':224C 'rec':297C,305C 'reject':344C,373C,451C 'reliabl':33B 'request':60B,142C,177C,347C,381C,408C,458C 'resolv':82C,157C,259C,284C,301C,362C,367C,489C,500C 'restrict':252C 'return':388C,448C 'right':405C 'rnic':55B,122C,273C 'rout':156C,286C,300C,369C,498C 'route.path':296C 'runtim':25B 'self':27B 'self-host':26B 'serv':266C 'shutdown':442C 'side':231C,430C 'siw':57B,125C 'sl':307C 'socket':35B 'soon':173C 'stack':182C 'stay':127C,433C 'still':421C,482C 'switch':132C 'take':222C 'therefor':168C 'track':483C 'tran':87C,100C,126C,145C,195C,333C 'transport':42B,313C,316C,326C,337C 'type':118C,256C 'uncondit':135C 'uniniti':41B,86C,128C,215C,225C 'via':144C 'vulner':79C 'whichev':264C 'whose':360C,487C 'wild':186C 'workqueu':204C 'would':414C 'wq':203C 'write':303C 'zero':184C,387C","nicknames":[],"mitigations":[],"who_affected":"Systems that load the RDS module and run an RDS listener or RDS connections over RDMA devices, especially iWARP NICs such as siw or Clang-built kernels. Hosts without RDS in use, or running only InfiniBand, are less exposed; the sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99166","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99166","severity":null,"published_at":"2026-10-28T11:17:37+00:00","modified_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}