CVE-2026-90081

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) component. This vulnerability occurs due to a synchronization issue in the congestion control mechanism. A remote attacker could exploit this by causing a sender to become indefinitely blocked on a congested port, leading to a denial of service (DoS) for affected services.

A moderate severity flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) congestion-control wake-up path. rds_cong_map_updated() increments the congestion generation and then checks waitqueue_active() on the map's wait queue and on rds_poll_waitq, but neither the atomic generation increment nor the plain waitqueue_active() load provides the ordering needed between the congestion-map stores and the wait-queue reads. A peer's congestion-map update can therefore race with a local sender in rds_cong_wait() or with a poll() waiter in rds_poll(): the updater observes an empty wait queue while the waiter still observes the port as congested, so the required wake-up is never issued. Because rds_cong_wait() is an interruptible sleep with no timeout, a sender blocked on a congested port stays blocked until the next congestion update from that peer arrives or a signal is delivered, and a poll() waiter likewise misses the map-updated notification. Only availability is affected; there is no impact on confidentiality or integrity. Red Hat Product Security rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). While the CVE description characterizes the trigger as a remote attacker causing a sender to become blocked, the Red Hat score reflects that the missed wake-up depends on racing local RDS sender or poll() activity against congestion-map updates. Per the current assessment, Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS kernels, and the RHEL CoreOS kernels shipped with OpenShift Container Platform 4 are not affected because the vulnerable code is not present in those builds; the Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel affect is still pending assessment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.