CVE Tools
Track your stack

CVE-2026-98253

RDMA/ucma: Serialize join and leave on copy_to_user failure

No known exploitation. EPSS puts it in the 3rd percentile. Fixed versions are out.

CVSS 3.17.8HighEPSS percentile3rd0.1% chance in 30 daysCISA KEVNot listedNo confirmed exploitation
No public exploit knownFix1 product4 fixed builds listed below

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

  • LinuxAffected: ≥ 60d613b39e8d0c9f3b526e9c96445422b4562d76, < 29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9Upgrade to: 29b9ed83d8bfab5c6e11fcbf1aa836aa4ae26cb9Affected: ≥ fe454dc31e84f8c14cb8942fcb61666c9f40745b, < 52172e11bd074ccaded21740ffeb67123f01dd00Upgrade to: 52172e11bd074ccaded21740ffeb67123f01dd00Affected: ≥ fe454dc31e84f8c14cb8942fcb61666c9f40745b, < 01e29d0d78a8f66f221625720a04939eef5ec1f6Upgrade to: 01e29d0d78a8f66f221625720a04939eef5ec1f6Affected: ≥ fe454dc31e84f8c14cb8942fcb61666c9f40745b, < ae805d204cf1f15b87d1bf3529b4c649f3519420Upgrade to: ae805d204cf1f15b87d1bf3529b4c649f3519420 + 7 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copy_to_user failure rdma_join_multicast() queues RoCE work that later reads the ucma_multicast through event->param.ud.private_data, then list_add()s the CMA multicast at the head of id_priv->mc_list. rdma_leave_multicast() matches only by sockaddr and destroys the first hit. ucma_process_join() used to drop ctx->mutex after a successful join and retake it only if copy_to_user() failed. Two concurrent JOIN_MCAST calls with the same address can therefore insert a second CMA entry before the first thread's leave. leave then cancels the newer work and the older worker still dereferences the ucma_multicast that the first thread frees. Keep ctx->mutex held from rdma_join_multicast() through copy_to_user() and, on -EFAULT, through rdma_leave_multicast() so leave cannot miss this join. Do not leave if join itself failed: that path never published this address on mc_list, and a leave-by-addr would destroy an earlier successful join.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS3rd
CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.1% chance of exploitation activity in the next 30 days, which ranks it in the 3rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

3 events over 1 day, from the signal feeds we watch.

  1. Record updated
  2. Publishedrecord updated

Affected products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

  • Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
  • Attack Complexity LowNo special conditions — the attack can be reliably reproduced
  • Privileges Required LowRequires basic user-level privileges
  • User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

  • Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

  • Confidentiality HighTotal information disclosure — all data in the component is compromised
  • Integrity HighTotal loss of integrity — attacker can modify any data in the component
  • Availability HighTotal denial of service — the component is completely unavailable

Sources

References in the record

And 5 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Linux, not every advisory.