{"id":"CVE-2026-99212","kind":"vulnerability","aliases":["CVE-2026-99212"],"related":[],"title":"Linux kernel RDS: failed route resolution frees connection id, causing use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: don't let the rdma_cm destroy an id RDS still owns on route failure\n\nrds_rdma_cm_event_handler_cmn() hands the return value of\nrdma_resolve_route() straight back to the rdma_cm on\nRDMA_CM_EVENT_ADDR_RESOLVED.  A synchronous failure there - -ENOMEM\nfrom the route work allocation, an SA query that cannot be set up, a\nRoCE route with no usable device - makes addr_handler() destroy the\nid the event was delivered on.  That id is ic->i_cm_id, and nothing\nclears the pointer: the connection sits in RDS_CONN_CONNECTING with a\nfreed id until its shutdown calls rdma_disconnect() and\nrdma_destroy_id() on it.\n\nThe ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect()\nforces a zero return while ic->i_cm_id == cm_id, as the comment there\nexplains.  Do the same here - drop the connection and return 0 - so\nthe id stays RDS's to destroy from the shutdown, and the reconnect\ngets a fresh one.","summary":"When RDS route resolution fails synchronously on the RDMA address-resolved event, the rdma_cm layer destroys the connection's cm id while RDS still holds the pointer. The connection then operates on a freed id until shutdown, which is a use-after-free that can crash the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infiniband","linux-kernel","rdma","rds","roce","runtime"],"not_affected_if":["no-rdma-hardware","rds-module-not-loaded"],"how_to_check":null,"fix":"- Update the Linux kernel to a release that includes the upstream commit 'net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure'.","status":"open","published_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:48+00:00","updated_at":"2026-10-28T11:33:48+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T11:33:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure'.","reach":"unknown","title":"Linux kernel RDS: failed route resolution frees connection id, causing use-after-free","impact":"medium","summary":"When RDS route resolution fails synchronously on the RDMA address-resolved event, the rdma_cm layer destroys the connection's cm id while RDS still holds the pointer. The connection then operates on a freed id until shutdown, which is a use-after-free that can crash the kernel.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","rds","rdma","infiniband","roce"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel crash or memory corruption from a use-after-free","analyst_note":"Check the kernel.org stable commit and NVD for the affected version ranges and whether the trigger is reachable remotely; the sources give no CVSS score.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["rds-module-not-loaded","no-rdma-hardware"],"who_is_affected":"Systems running a Linux kernel with the RDS socket protocol and RDMA connection manager in use, typically RDS over InfiniBand or RoCE. Hosts that do not load the rds module or use RDS can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3626,"output_tokens":527,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-99212':17A,20A '0':240C 'addr':130C,158C 'address':39B 'address-resolv':38B 'alloc':141C 'alreadi':207C 'avoid':208C 'back':121C 'call':194C 'cannot':146C 'case':206C 'caus':10A 'clear':177C 'cm':44B,50B,96C,108C,125C,128C,173C,212C,222C,224C 'cmn':111C 'comment':228C 'conn':185C 'connect':8A,48B,59B,181C,186C,214C,237C 'crash':77B 'cve':15A,18A 'deliv':166C 'destroy':46B,97C,160C,199C,248C 'devic':156C 'disconnect':196C 'drop':235C 'enomem':136C 'event':41B,109C,129C,164C 'explain':230C 'fail':4A,33B 'failur':105C,134C 'follow':85C 'forc':215C 'free':7A,14A,74B 'freed':64B,189C 'fresh':257C 'get':255C 'hand':112C 'handler':110C,159C 'hold':55B 'ib':211C 'ic':171C,220C 'id':9A,51B,65B,99C,162C,169C,174C,190C,200C,223C,225C,243C 'infiniband':21B 'initi':213C 'kernel':2A,24B,79B,83C 'layer':45B 'let':93C 'linux':1A,23B,82C 'linux-kernel':22B 'make':157C 'net/rds':90C 'noth':176C 'one':258C 'oper':61B 'own':102C 'pointer':57B,179C 'queri':144C 'rdma':25B,37B,43B,95C,107C,117C,124C,127C,195C,198C 'rds':3A,26B,30B,53B,100C,106C,184C,210C,245C 'reconnect':254C 'resolut':6A,32B 'resolv':40B,89C,118C,131C,205C 'return':114C,218C,239C 'roce':27B,151C 'rout':5A,31B,104C,119C,139C,152C,204C 'runtim':28B 'sa':143C 'set':148C 'shutdown':67B,193C,251C 'sit':182C 'stay':244C 'still':54B,101C 'straight':120C 'synchron':34B,133C 'usabl':155C 'use':12A,72B 'use-after-fre':11A,71B 'valu':115C 'vulner':86C 'work':140C 'zero':217C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the RDS socket protocol and RDMA connection manager in use, typically RDS over InfiniBand or RoCE. Hosts that do not load the rds module or use RDS can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99212","severity":null,"published_at":"2026-10-28T11:17:42+00:00","modified_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}