CVE-2026-98359 (GCVE-0-2026-98359)
Vulnerability from cvelistv5
Published
2026-10-06 08:46
Modified
2026-10-19 09:18
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ib_get_eth_speed ib_device_get_netdev() intentionally returns a referenced net_device even when it is unregistering, so matching and cleanup callers can still find the association. The reference keeps struct net_device allocated, but does not guarantee that the device remains operational. ib_get_eth_speed() uses the returned device operationally by invoking its ethtool callback. Although that call is made under RTNL, the function does not verify the registration state first. An asynchronous RDMA port query can therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit have completed. Check for NETREG_REGISTERED while holding RTNL and return -ENODEV for a device which is being unregistered. Keeping RTNL across the check and the ethtool operation prevents unregister from starting between them. Keep the speed fallback and warning under RTNL as well, so the warning can safely read netdev->name. Drop the netdev reference before releasing RTNL once all accesses to the device are complete.
References
Impacted products
Vendor Product Version
Linux Linux Version: d41861942fc55c14b6280d9568a0d0112037f065
Version: d41861942fc55c14b6280d9568a0d0112037f065
Version: d41861942fc55c14b6280d9568a0d0112037f065
Version: d41861942fc55c14b6280d9568a0d0112037f065
Version: d41861942fc55c14b6280d9568a0d0112037f065
Version: d41861942fc55c14b6280d9568a0d0112037f065
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be4b44c8b47c67a04c08b1a0aba18006b749ae6a",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "45c60ffc79771bad154f224a05753191cf1b37bc",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "a219459fbd1b2598e63c81a52847eba6c28b72d2",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "5bd42f74ec3b4f4687fb600f367af0828d513b3c",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Reject unregistering netdevs in ib_get_eth_speed\n\nib_device_get_netdev() intentionally returns a referenced net_device even\nwhen it is unregistering, so matching and cleanup callers can still find\nthe association. The reference keeps struct net_device allocated, but does\nnot guarantee that the device remains operational.\n\nib_get_eth_speed() uses the returned device operationally by invoking its\nethtool callback. Although that call is made under RTNL, the function does\nnot verify the registration state first. An asynchronous RDMA port query\ncan therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit\nhave completed.\n\nCheck for NETREG_REGISTERED while holding RTNL and return -ENODEV for a\ndevice which is being unregistered. Keeping RTNL across the check and the\nethtool operation prevents unregister from starting between them.\n\nKeep the speed fallback and warning under RTNL as well, so the warning can\nsafely read netdev-\u003ename. Drop the netdev reference before releasing RTNL\nonce all accesses to the device are complete."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - ib_get_eth_speed() is reached via ib_query_port() -\u003e driver query_port (rxe_query_port, siw_query_port, irdma, bnxt_re, hns, mana, erdma...) from local uverbs QUERY_PORT ioctls on /dev/infiniband/uverbs*, RDMA_NLDEV_CMD_PORT_GET netlink or the ib cache work; no remote peer supplies data to this path.\nAC:H - The faulty call needs the port\u0027s bound netdev to be between NETDEV_UNREGISTER/ndo_uninit and the queued ib_unregister_device_queued() teardown. The querying user can hammer query_port, but unregistering that netdev is an admin or driver action they cannot arrange on demand.\nPR:L - The query side needs no capability: RDMA_NLDEV_CMD_PORT_GET has no RDMA_NL_ADMIN_PERM flag, and uverbs query_port only needs an open uverbs device. Binding rxe/siw via RDMA_NLDEV_CMD_NEWLINK needs init-ns CAP_NET_ADMIN, so the attacker relies on an existing RoCE/iWARP port.\nUI:N - No victim action is needed. The attacker only issues port queries, and the unregister event is a system state change (counted under AC:H), not a user being tricked into doing something.\nS:U - The bug and its impact are both in the host kernel. No VM, IOMMU or sandbox boundary is crossed.\nC:H - __ethtool_get_link_ksettings() runs on a netdev whose ndo_uninit has already run. For example, ipvlan_ethtool_get_link_ksettings() dereferences ipvlan-\u003ephy_dev after ipvlan_port_put() dropped the port\u0027s phy_dev reference, which lets freed net_device memory be read.\nI:H - The stale or freed lower net_device is used to load and call ethtool_ops-\u003eget_link_ksettings through a function pointer. A use-after-free that reaches an indirect call can be groomed toward control-flow hijack.\nA:H - syzbot hit this as a kernel crash. Calling ethtool callbacks on a torn-down device (freed pcpu/port state in macvlan/ipvlan/team uninit) oopses the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:18:09.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be4b44c8b47c67a04c08b1a0aba18006b749ae6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/45c60ffc79771bad154f224a05753191cf1b37bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a219459fbd1b2598e63c81a52847eba6c28b72d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bd42f74ec3b4f4687fb600f367af0828d513b3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5"
        }
      ],
      "title": "RDMA/core: Reject unregistering netdevs in ib_get_eth_speed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98359",
    "datePublished": "2026-10-06T08:46:45.938Z",
    "dateReserved": "2026-09-25T10:25:14.344Z",
    "dateUpdated": "2026-10-19T09:18:09.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.