{"id":"CVE-2026-98072","revision":"8897b684196547ce988fe2731a62d7ac","records":[{"revision":"8897b684196547ce988fe2731a62d7ac","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98072","aliases":[],"title":"net/rds: use wq_has_sleeper() in release_in_xmit()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: use wq_has_sleeper() in release_in_xmit()\n\nrelease_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then\nchecks waitqueue_active() to decide whether anyone needs waking.\nclear_bit_unlock() is only a release operation: it orders the\ncritical section before the bit clear, but does not order the\nsubsequent plain load of the wait queue head after it.  The waiter\nside does the mirror image - it adds itself to the wait queue and\nthen tests the bit.  That is the classic store-buffering pattern: the\nreleasing CPU can read the wait queue as empty while the waiting CPU\nstill reads the bit as set, so the sleeper is never woken.\n\nThe waiters are rds_conn_shutdown() and rds_tcp_reset_callbacks(),\nboth in uninterruptible wait_event() with no timeout.  A lost wake-up\nstrands the shutdown worker on its single-threaded workqueue until\nsome other sender releases the bit again - and on a connection that\nis being torn down precisely because it failed, there may never be\nanother sender.\n\nThe barrier used to be there: release_in_xmit() did clear_bit()\nfollowed by smp_mb__after_atomic() until commit 1422f28826d2 (\"rds:\nintroduce acquire/release ordering in acquire/release_in_xmit()\")\nfolded both into clear_bit_unlock(), which strengthened the lock\nhand-off but silently dropped the full barrier the wake-up check\ndepends on.  The refill counterpart, release_refill() in\nnet/rds/ib_recv.c, still carries its smp_mb__after_atomic() for\nexactly this reason.\n\nUse wq_has_sleeper(), which is waitqueue_active() preceded by the\nrequired full barrier.","state":0,"publishedAt":"2026-09-25T10:24:12.675+00:00","modifiedAt":"2026-10-19T09:13:21.939+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/rds/send.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1e1e4316fcaeb9cd6bc56c91127e88625237dd44\",\n                            \"lessThan\": \"6f552364d97cf4005c7a58f11c9f79e14e269865\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8c378cc522aedd5fa5aa53486b43a4d552fbbd5c\",\n                            \"lessThan\": \"a94b1dfc82454c5bc068e71c25393af674daf63b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"52287ed416a10bc3d3e204a3186d9509ab3ee634\",\n                            \"lessThan\": \"5a806ed1eb46850ca4159a18b2a8c4b70f0c1341\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4a4dffdff9ea6201665f5d0a5042011d09bd527f\",\n                            \"lessThan\": \"3d401934b7edb3ccb07d982dabadd04c45ee307c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1422f28826d2a0c11e5240b3e951c9e214d8656e\",\n                            \"lessThan\": \"ed7ee0cd0e136d02f87f13181b1a89880463c7e9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1422f28826d2a0c11e5240b3e951c9e214d8656e\",\n                            \"lessThan\": \"a269795107f45adc95975a83324f8fef40bec4ce\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1422f28826d2a0c11e5240b3e951c9e214d8656e\",\n                            \"lessThan\": \"3764627b30a283e611e652c4a2bb8cdc74a75a99\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1422f28826d2a0c11e5240b3e951c9e214d8656e\",\n                            \"lessThan\": \"6d0c8b7073913011459cf968cbbadd341e166bc3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bec6c4ce1169a565c58c347d5d0ac22e46d507d6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f781fb5177cdfd9a6c98cd94e30275457c6461ac\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"917135195200e20e5244b9c3f2bb40f3d5e02510\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d792459a6e2ae21c7f5107babd63e52e4c5ab93a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.214\",\n                            \"lessThan\": \"5.10.271\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.153\",\n                            \"lessThan\": \"5.15.222\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.83\",\n                            \"lessThan\": \"6.1.189\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.23\",\n                            \"lessThan\": \"6.6.158\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.311\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.273\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.11\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8.2\",\n                            \"lessThan\": \"6.9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/rds/send.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/6f552364d97cf4005c7a58f11c9f79e14e269865","https://git.kernel.org/stable/c/a94b1dfc82454c5bc068e71c25393af674daf63b","https://git.kernel.org/stable/c/5a806ed1eb46850ca4159a18b2a8c4b70f0c1341","https://git.kernel.org/stable/c/3d401934b7edb3ccb07d982dabadd04c45ee307c","https://git.kernel.org/stable/c/ed7ee0cd0e136d02f87f13181b1a89880463c7e9","https://git.kernel.org/stable/c/a269795107f45adc95975a83324f8fef40bec4ce","https://git.kernel.org/stable/c/3764627b30a283e611e652c4a2bb8cdc74a75a99","https://git.kernel.org/stable/c/6d0c8b7073913011459cf968cbbadd341e166bc3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98072","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98072","identifiers":["CVE-2026-98072"]},"retained":false,"historicalAffected":[]}],"coverage":[]}