{"id":"CVE-2026-98347","revision":"bfb42b90df4d438bb8374115e88b398b","records":[{"revision":"bfb42b90df4d438bb8374115e88b398b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98347","aliases":[],"title":"IB/IPoIB: Avoid restoring OPER_UP after multicast flush","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/IPoIB: Avoid restoring OPER_UP after multicast flush\n\nipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to\nprevent multicast joins while ipoib_mcast_dev_flush() is running, and\nrestores the flag afterwards if it was previously set.\n\nThis restore races with ipoib_ib_dev_down(). If the interface is brought\ndown while the flush is in progress, ipoib_ib_dev_down() clears\nIPOIB_FLAG_OPER_UP, but the flush path may set it again after the device\nhas already gone down.\n\nSince commit 894021a75291 (\"IB/ipoib: Make the carrier_on_task race\naware\"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP\nbeing cleared to terminate its rtnl_trylock() retry loop. If the flag is\nleft set after shutdown, the workqueue retries forever, causing teardown\nto deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while\nholding RTNL.\n\nInstead of overloading IPOIB_FLAG_OPER_UP to block multicast joins\nduring a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag.\nUse it together with IPOIB_FLAG_OPER_UP to determine whether multicast\njoins are allowed, avoiding the race with device shutdown.","state":0,"publishedAt":"2026-10-06T08:46:36.136+00:00","modifiedAt":"2026-10-19T09:17:58.195+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/infiniband/ulp/ipoib/ipoib.h\",\n                        \"drivers/infiniband/ulp/ipoib/ipoib_ib.c\",\n                        \"drivers/infiniband/ulp/ipoib/ipoib_multicast.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"344bacca8cd811809fc33a249f2738ab757d327f\",\n                            \"lessThan\": \"f973769fb7cb33ba0d4a64b7dcfee0cabaead938\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"344bacca8cd811809fc33a249f2738ab757d327f\",\n                            \"lessThan\": \"b72f38929f4b5aa83161fd3b22a7327207e51ec5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"344bacca8cd811809fc33a249f2738ab757d327f\",\n                            \"lessThan\": \"1b11e4b55b41d9e69a8e8d07622614202e2eaca9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"344bacca8cd811809fc33a249f2738ab757d327f\",\n                            \"lessThan\": \"326f7d34bd7e64de535566b65c0533b640df5a81\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"344bacca8cd811809fc33a249f2738ab757d327f\",\n                            \"lessThan\": \"5ad925d45f28464a5e043c9620880bb6a030da89\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"344bacca8cd811809fc33a249f2738ab757d327f\",\n                            \"lessThan\": \"188b334a6db36a8e0bfaaf59bc4020639a0f3aad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"344bacca8cd811809fc33a249f2738ab757d327f\",\n                            \"lessThan\": \"1ff3add37c329704ec46181b4ae4f00f9f16ce6f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"344bacca8cd811809fc33a249f2738ab757d327f\",\n                            \"lessThan\": \"9a141d3dc869d18b2eab35e999f4790a9b84e40f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a289c65ca49d2680a3d797e633e57a45573d1df2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"b81459c78935e4579a577b2366c5f8878d3c7fee\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8a9d8dc9ce83a90bfbbe69181acc4cf1beff46f5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dfe809702a11bd7fb91c882fb55620e39ce22109\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"87160fb51bc343793cc8f5f031a87f1a35aecb82\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"749fd55dd210f9676f0d445a6efaaa3bec65174a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3.2.84\",\n                            \"lessThan\": \"3.3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"3.10.105\",\n                            \"lessThan\": \"3.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"3.12.65\",\n                            \"lessThan\": \"3.13\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"3.16.39\",\n                            \"lessThan\": \"3.17\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.4.24\",\n                            \"lessThan\": \"4.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.7.7\",\n                            \"lessThan\": \"4.8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/infiniband/ulp/ipoib/ipoib.h\",\n                        \"drivers/infiniband/ulp/ipoib/ipoib_ib.c\",\n                        \"drivers/infiniband/ulp/ipoib/ipoib_multicast.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/f973769fb7cb33ba0d4a64b7dcfee0cabaead938","https://git.kernel.org/stable/c/b72f38929f4b5aa83161fd3b22a7327207e51ec5","https://git.kernel.org/stable/c/1b11e4b55b41d9e69a8e8d07622614202e2eaca9","https://git.kernel.org/stable/c/326f7d34bd7e64de535566b65c0533b640df5a81","https://git.kernel.org/stable/c/5ad925d45f28464a5e043c9620880bb6a030da89","https://git.kernel.org/stable/c/188b334a6db36a8e0bfaaf59bc4020639a0f3aad","https://git.kernel.org/stable/c/1ff3add37c329704ec46181b4ae4f00f9f16ce6f","https://git.kernel.org/stable/c/9a141d3dc869d18b2eab35e999f4790a9b84e40f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98347","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98347","identifiers":["CVE-2026-98347"]},"retained":false,"historicalAffected":[]}],"coverage":[]}