CVE-2026-98360

A flaw was found in the Linux kernel's Remote Direct Memory Access over Converged Ethernet (RDMA/rxe) driver. A local user can trigger a Denial of Service (DoS) or system crash by attempting to attach to a multicast group when network device operations fail. In this scenario, improper error handling frees the allocated multicast group structure while retaining a reference in the lookup tree, causing a use-after-free condition during subsequent lookups.

A use-after-free flaw rated by Red Hat Product Security as MODERATE impact was found in the Linux kernel RDMA/rxe (Soft-RDMA over Ethernet) driver. When a local user with privileges to use RDMA devices attaches a user-space UD queue pair to a multicast group (ATTACH_MCAST), rxe_get_mcg() publishes the newly allocated multicast group in rxe->mcg_tree before rxe_mcast_add() programs the backing Ethernet multicast address. If rxe_mcast_add() then fails (for example -ENODEV when the backing netdev has been removed, or a propagated dev_mc_add() error), the error unwind frees the published group without removing it from the tree. A later lookup of the same multicast GID dereferences the freed struct rxe_mcg, resulting in a slab-use-after-free that causes a kernel crash and denial of service.

This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 8 (8.8 and later update streams) and Red Hat Enterprise Linux 9 (9.4 and later update streams), as well as the OpenShift Container Platform RHEL CoreOS 9-based streams 4.16 and later; for these affected streams the fix is currently deferred to a future update. The residual risk on affected streams is limited to availability, since exploitation requires local access with privileges to perform RDMA multicast operations and depends on an uncommon error condition during multicast address programming. Earlier RHEL 6, 7, 8, and 9 update streams, RHEL 10, Red Hat In-Vehicle OS, and OpenShift Container Platform 4.12 through 4.15 are not affected because the vulnerable code is not present in those kernels.

Red Hat rates this flaw MODERATE (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) while the upstream CVEORG record scores it 7.0 (IMPORTANT, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The difference is that the upstream score assumes high confidentiality and integrity impacts, whereas Red Hat's assessment finds the practical impact limited to availability, as dereferencing the freed multicast group structure results in a kernel crash rather than exposure or modification of data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.