Race in Linux kernel IPoIB driver restores link state after shutdown
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Partial Red Hat: 7 without a fix
No CVSS vector from any source. Fix status from CNA and Red Hat.
Summary
The Linux kernel IPoIB driver can set its operational-up flag again after the interface has gone down during a multicast flush. The stale flag keeps the carrier-on workqueue retrying forever, so teardown deadlocks while holding RTNL. Bringing the interface down during a multicast flush triggers the hang.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPER_UP after multicast flush ipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to prevent multicast joins while ipoib_mcast_dev_flush() is running, and restores the flag afterwards if it was previously set. This restore races with ipoib_ib_dev_down(). If the interface is brought down while the flush is in progress, ipoib_ib_dev_down() clears IPOIB_FLAG_OPER_UP, but the flush path may set it again after the device has already gone down. Since commit 894021a75291 ("IB/ipoib: Make the carrier_on_task race aware"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP being cleared to terminate its rtnl_trylock() retry loop. If the flag is left set after shutdown, the workqueue retries forever, causing teardown to deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while holding RTNL. Instead of overloading IPOIB_FLAG_OPER_UP to block multicast joins during a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag. Use it together with IPOIB_FLAG_OPER_UP to determine whether multicast joins are allowed, avoiding the race with device shutdown.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 3.2.84 to before 3.3; 3.10.105 to before 3.11; 3.12.65 to before 3.13; 3.16.39 to before 3.17; 4.4.24 to before 4.5; 4.7.7 to before 4.8 | 3.3, 3.11, 3.13, 3.17, 4.5, 4.8 | Patch available | CNA |
| Linux | Linux | 4.8 and later | 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3 | Patch available | CNA |
- Linux VendorLinux Affected 3.2.84 to before 3.3; 3.10.105 to before 3.11; 3.12.65 to before 3.13; 3.16.39 to before 3.17; 4.4.24 to before 4.5; 4.7.7 to before 4.8 Fixed in 3.3, 3.11, 3.13, 3.17, 4.5, 4.8 Patch available CNA
- Linux VendorLinux Affected 4.8 and later Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3 Patch available CNA
Remediation
Update the Linux kernel to a fixed version for your branch: 3.3, 3.11, 3.13, 3.17, 4.5, 4.8, 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 or 7.3. Red Hat's plan is none available for Red Hat Enterprise Linux 7, 8, 9 and 10 and OpenShift Container Platform 4 and 5, and no fix planned for Red Hat Enterprise Linux 6.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA Linux (Linux) Fixed in 3.3, 3.11, 3.13, 3.17, 4.5, 4.8
- Fix · CNA Linux (Linux) Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-06 Threatist record created from CVE-2026-98347
- 2026-10-06 Alias added: GHSA-8j4r-887v-cjjx
- 2026-10-11 Affected versions changed · Red Hat
- 2026-10-11 CVSS score added · Red Hat
- 2026-10-19 Fix available: Linux/[email protected] · CNA
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-01 Affected versions changed · Red Hat
References
Other 8
- https://git.kernel.org/stable/c/f973769fb7cb33ba0d4a64b7dcfee0cabaead938
- https://git.kernel.org/stable/c/b72f38929f4b5aa83161fd3b22a7327207e51ec5
- https://git.kernel.org/stable/c/1b11e4b55b41d9e69a8e8d07622614202e2eaca9
- https://git.kernel.org/stable/c/326f7d34bd7e64de535566b65c0533b640df5a81
- https://git.kernel.org/stable/c/5ad925d45f28464a5e043c9620880bb6a030da89
- https://git.kernel.org/stable/c/188b334a6db36a8e0bfaaf59bc4020639a0f3aad
- https://git.kernel.org/stable/c/1ff3add37c329704ec46181b4ae4f00f9f16ce6f
- https://git.kernel.org/stable/c/9a141d3dc869d18b2eab35e999f4790a9b84e40f
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-98347 · CVE Program
- CVE-2026-98347 · NVD
- FIRST EPSS
- GHSA-8j4r-887v-cjjx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-98347 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences