CVE-2026-98070

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. Due to improper synchronization during TCP connection path resets, transmit operations can run concurrently while connection state is being modified. An attacker could exploit this timing window during connection resets, leading to kernel state corruption and a Denial of Service (DoS) caused by a system crash.

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) over TCP implementation, rated Moderate by Red Hat Product Security. When an RDS-TCP connection path is reset, rds_tcp_reset_callbacks() quiesced the transmit path by waiting to sample the RDS_IN_XMIT flag clear rather than acquiring it. Because sampling the flag is not the same as owning it, and because of weak memory ordering on some architectures, the transmit path could re-acquire the flag right after the wait completed and run concurrently with rds_send_path_reset() while it rewrote the connection's transmit state. An attacker able to trigger this timing window during connection resets could cause kernel state corruption and a denial of service by crashing the system. Red Hat rates this flaw Moderate with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which is lower than the CVE.org score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H); the difference reflects Red Hat's assessment of a local attack vector requiring privileges, while the CVE.org record assumes a network vector with no privileges required, and both recognize the high complexity of winning the race. In the current assessment, all maintained Red Hat products are marked not affected because the vulnerable code is not present in the shipped kernel builds; this includes RHEL 7 through RHEL 10 kernels (kernel and kernel-rt), RHEL In-Vehicle OS (In-Vehicle OS) kernels, and OpenShift RHEL CoreOS kernels. The only remaining entry, the kernel in Red Hat Enterprise Linux 6 Extended Lifecycle Support, is resolved as out of support scope (OOSS), so no fix is planned for that stream; the residual risk is limited to RHEL 6 ELS systems using RDS over TCP, which no longer receive routine security updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.