{"schema":"threatline.record/2","record":{"id":"CVE-2026-98070","aliases":[],"summary":"net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()\n\nrds_tcp_reset_callbacks() quiesces the transmit path by setting the\npath state to RDS_CONN_RESETTING and then waiting for RDS_IN_XMIT to\nbe sampled clear before swapping the underlying socket and calling\nrds_send_path_reset().\n\nSampling the bit clear is not the same as owning it: rds_send_xmit()\ncan re-acquire RDS_IN_XMIT right after the wait_event() returns.  Its\nstate recheck after taking the lock is a store-buffering pattern (the\nresetter writes the state and reads the bit, the sender writes the\nbit and reads the state) and acquire_in_xmit() is only an acquire\noperation, so on weakly ordered architectures both sides can miss\neach other's write and the transmit path then runs concurrently with\nrds_send_path_reset() rewriting cp_xmit_* state - which is exactly\nwhat the comment above rds_send_path_reset() tells its callers to\nprevent.\n\nTake the lock instead, hold it across the socket swap and\nrds_send_path_reset(), and release it with a wake-up at the end.  The\nlock-ordering constraint documented above the wait still holds: the\nlock is acquired before lock_sock(), so a sender inside tcp_sendmsg()\ncan never be waited on while we hold the socket lock.\n\nTwo details of the old code go away with the same change:\n\n - t_sock is now read only after the lock is acquired.  The old code\n   cached it before waiting; the teardown in rds_conn_shutdown()\n   releases that socket and clears t_sock, so a pointer cached before\n   the wait can be stale by the time the accept path resumes.  Reading\n   it under RDS_IN_XMIT is what makes the exclusion complete once the\n   teardown owns the same lock, which the next patch arranges; until\n   then the teardown still only samples the bit, and the two paths\n   remain as exposed to each other as they are today.\n\n - The old !osock early path called rds_send_path_reset() with no\n   serialization at all.  It now runs under the lock like the normal\n   path.  The conditional RDS_CONN_RESETTING transition of the\n   previous patch happens before the socket check either way: a path\n   found without a socket is either still connecting (its reconnect\n   worker blocked on t_conn_path_lock) and legitimately goes\n   RESETTING -> UP on the new socket, or it has been torn down\n   meanwhile and is dropped.\n\nThe in-function comment describing the old wait-based quiesce is\nrewritten to describe the lock-based one, and the stale block comment\nabove the function (which still described a return value and an\nincomplete list of t_sock writers) is refreshed to name all four\nwriters - the connect, accept, teardown and swap paths - and what\nserializes each of them.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98070","source_modified_at":"2026-10-19T09:13:19.953Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"670af4e4a4de5e6bb5daee3838485571a0caa5fa","status":"affected","versionType":"git"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"830a2e21b200c6b6fdccc63dd3f23932bf7a894b","status":"affected","versionType":"git"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"a05790cb4ff03f797d76906990b148d83f63e7a3","status":"affected","versionType":"git"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"d184e6dd4b8f3c20c018595fd09795a66b46c8ef","status":"affected","versionType":"git"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"d625112564c3e980e02504270222b49b82690cee","status":"affected","versionType":"git"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"8e4c3b7844c906c7097b4cfedd9dd1f48c9a6a92","status":"affected","versionType":"git"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"062d9e008c67289e8e1b221ecdd8f9d60566d012","status":"affected","versionType":"git"},{"version":"335b48d980f631fbc5b233cbb3625ac0c86d67cb","lessThan":"02c5f9dc2efd823e061954d564ce00bacd1bebeb","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98070","source_modified_at":"2026-10-19T09:13:19.953Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98070","source_modified_at":"2026-10-19T09:13:19.953Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"670af4e4a4de5e6bb5daee3838485571a0caa5fa","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98070","source_modified_at":"2026-10-19T09:13:19.953Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"830a2e21b200c6b6fdccc63dd3f23932bf7a894b","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98070","source_modified_at":"2026-10-19T09:13:19.953Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"8e4c3b7844c906c7097b4cfedd9dd1f48c9a6a92","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98070","source_modified_at":"2026-10-19T09:13:19.953Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"062d9e008c67289e8e1b221ecdd8f9d60566d012","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98070","source_modified_at":"2026-10-19T09:13:19.953Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"02c5f9dc2efd823e061954d564ce00bacd1bebeb","basis":"first unaffected version stated in the CVE record"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00475,"percentile":0.40112,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:24:11.481Z","modified_at":"2026-10-19T09:13:19.953Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98070","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:13:19.953Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98070","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/670af4e4a4de5e6bb5daee3838485571a0caa5fa"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/830a2e21b200c6b6fdccc63dd3f23932bf7a894b"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/a05790cb4ff03f797d76906990b148d83f63e7a3"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/d184e6dd4b8f3c20c018595fd09795a66b46c8ef"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/d625112564c3e980e02504270222b49b82690cee"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8e4c3b7844c906c7097b4cfedd9dd1f48c9a6a92"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/062d9e008c67289e8e1b221ecdd8f9d60566d012"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/02c5f9dc2efd823e061954d564ce00bacd1bebeb"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:13:19.953Z","content_hash":"e36a8c95ed67f5c78846e5882f6ea83b753aa319d477e07ed84d6c1f2d192892"}}