CVE-2026-99166

Что произошло

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but the event switch dereferences it: unconditionally in the RDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(), and (with a connection context) in the ROUTE_RESOLVED and ESTABLISHED cases. An RDS listener on an iWARP device therefore crashes the kernel as soon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO the wild load becomes a NULL dereference at offset 0xa0 (&trans->cm_handle_connect) in the iw_cm_wq workqueue. GCC masks the bug in default builds by folding the uninitialized load into &rds_ib_transport; Clang-built kernels take the real uninitialized path and oops. The active side can land on a non-IB device too: the id that rds_ib_conn_path_connect() creates is not restricted to a node type, so rdma_resolve_addr() binds it to whichever device serves the local address, and an iWARP RNIC on the same netdev qualifies. The crash there is different: resolving a route on an iWARP id never fills in cm_id->route.path_rec, and the ROUTE_RESOLVED case writes path_rec[0].sl before it calls into the transport. The iWARP transport was dropped long ago and IB is the only transport left, so make that explicit: initialize trans to &rds_ib_transport at declaration, drop the conditional assignment, reject a connect request that arrives on a non-IB device, and drop a connection whose address resolved to one instead of resolving a route on it. The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUEST on purpose: a non-zero return from the handler makes rdma_cm destroy the id the event was delivered on, which is right for the request's freshly created id but would free a connection id that RDS still owns for any other event. On the active side the id stays ic->i_cm_id and the connection's shutdown destroys it, so that case returns 0. [achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of bailing out for every event on a non-IB device, so that rdma_cm does not destroy connection ids RDS still tracks; drop a connection whose address resolved to a non-IB device before a route is resolved on it; changelog adjusted]

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
  "lessThan": "0d15e853aa88da5375edd32b39d08a048b64a1c5",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
  "lessThan": "8c77774535c3d6162929521a6fa11e3db086fa32",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
  "lessThan": "8973f70cb068012d83cff1cfa3f45ef94ab02267",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
  "lessThan": "a2fde862b98db8908e2ebaffbb35a75a0e9d5b33",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
  "lessThan": "074bb7cdc3e26afa698888ba56fc1df0e3f24650",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
  "lessThan": "5f23e4e3a31dacfd82a8f56be253adc0910ee84f",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
  "lessThan": "ca14c289ed9ffed6cc64290d039e923e5720a8bf",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "dcdede0406d30e14a6ed727dce69dfac0518371d",
  "lessThan": "492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "4.6"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "4.6",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "5.10.273",
  "versionType": "semver",
  "lessThanOrEqual": "5.10.*"
}

{
  "status": "unaffected",
  "version": "5.15.224",
  "versionType": "semver",
  "lessThanOrEqual": "5.15.*"
}

{
  "status": "unaffected",
  "version": "6.1.191",
  "versionType": "semver",
  "lessThanOrEqual": "6.1.*"
}

{
  "status": "unaffected",
  "version": "6.6.161",
  "versionType": "semver",
  "lessThanOrEqual": "6.6.*"
}

{
  "status": "unaffected",
  "version": "6.12.115",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.59",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.13",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-01T21:13:22.718781+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.020879+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.020879+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.020879+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-01T21:13:22.718781+00:00"
  },
  "references": [
    "cve",
    "ghsa",
    "nvd"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-30T12:57:42.020879+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены02.11.2026, 00:13
2. Данные обновлены31.10.2026, 12:00
3. Данные обновлены30.10.2026, 15:58
4. Данные обновлены28.10.2026, 23:53
5. Данные обновлены28.10.2026, 18:00
6. Опубликована28.10.2026, 15:17

Личная заметка и статус

Другие CVE того же продукта