CVE-2026-98072

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. This vulnerability allows an attacker to cause a Denial of Service (DoS) by triggering connection resets or teardowns. Due to a missing memory barrier during transmission release, a race condition can cause the system to drop wake-up notifications for waiting threads. Consequently, connection shutdown workers can become stranded in an uninterruptible sleep state, hanging affected kernel processes indefinitely.

A MODERATE severity denial of service flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. In release_in_xmit() in net/rds/send.c, the RDS_IN_XMIT bit is cleared with clear_bit_unlock(), which provides only release ordering and does not order the subsequent waitqueue_active() check after it with a full barrier. A waiter adds itself to the wait queue and then tests the bit, so under this store-buffering race the releasing CPU can observe an empty wait queue while the waiter still observes the bit as set, and the sleeper is never woken. The affected waiters, rds_conn_shutdown() and rds_tcp_reset_callbacks(), use uninterruptible wait_event() calls with no timeout, so a lost wake-up can strand the connection shutdown worker on its single-threaded workqueue indefinitely, hanging affected kernel processes and causing a denial of service. Exploitation requires winning a narrow race window during RDS connection resets or teardowns. Red Hat rates this flaw with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Based on the current affectedness records, Red Hat Enterprise Linux 7, 8, 9, and 10 (including the Real Time kernels), Red Hat In-Vehicle OS, and OpenShift Container Platform RHEL CoreOS images are not affected because the vulnerable code is not present in the shipped kernel versions; the only remaining record, the Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel, is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.