All vulnerabilities
CVE-2026-98359

Linux: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in45c60ffc79771bad154f224a05753191cf1b37bcAlso 520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e, 5bd42f74ec3b4f4687fb600f367af0828d513b3cCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 45c60ffc79771bad154f224a05753191cf1b37bcLinuxCVE List
  • 520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5eLinuxCVE List
  • 5bd42f74ec3b4f4687fb600f367af0828d513b3cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Reject unregistering netdevs in ib_get_eth_speed

ib_device_get_netdev() intentionally returns a referenced net_device even when it is unregistering, so matching and cleanup callers can still find the association. The reference keeps struct net_device allocated, but does not guarantee that the device remains operational.

ib_get_eth_speed() uses the returned device operationally by invoking its ethtool callback. Although that call is made under RTNL, the function does not verify the registration state first. An asynchronous RDMA port query can therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit have completed.

Check for NETREG_REGISTERED while holding RTNL and return -ENODEV for a device which is being unregistered. Keeping RTNL across the check and the ethtool operation prevents unregister from starting between them.

Keep the speed fallback and warning under RTNL as well, so the warning can safely read netdev->name. Drop the netdev reference before releasing RTNL once all accesses to the device are complete.

Text from CVE List

Affected versions 14

  • Linuxaffected: d41861942fc55c14b6280d9568a0d0112037f065 before be4b44c8b47c67a04c08b1a0aba18006b749ae6aCVE List
  • Linuxaffected: d41861942fc55c14b6280d9568a0d0112037f065 before 45c60ffc79771bad154f224a05753191cf1b37bcCVE List
  • Linuxaffected: d41861942fc55c14b6280d9568a0d0112037f065 before 520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5eCVE List
  • Linuxaffected: d41861942fc55c14b6280d9568a0d0112037f065 before a219459fbd1b2598e63c81a52847eba6c28b72d2CVE List
  • Linuxaffected: d41861942fc55c14b6280d9568a0d0112037f065 before 5bd42f74ec3b4f4687fb600f367af0828d513b3cCVE List
  • Linuxaffected: d41861942fc55c14b6280d9568a0d0112037f065 before ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5CVE List
  • Linuxaffected: 4.14CVE List
  • Linuxunaffected: all versions before 4.14CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 6