CVE-2026-53355: net: rds: clear i_sends on setup unwind
In the Linux kernel, the following vulnerability has been resolved:
net: rds: clear isends on setup unwind
The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released.
When rdsibsetupqp() fails after allocating isends but before allocating irecvs, the sendsout path frees isends without clearing the pointer. A later shutdown pass can still treat that stale pointer as a live send ring allocation.
Clear isends after vfree() in the error unwind path so the existing shutdown logic continues to use the correct ownership state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Apply the fix described as: when rds_ib_setup_qp() fails after allocating i_sends but before allocating i_recvs, ensure the teardown/error unwind path frees i_sends and also clears the i_sends pointer so the later shutdown pass does not treat it as a live send ring allocation.
Linux kernel (net: rds) clear i_sends on setup unwind = true
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53355?
The severity of CVE-2026-53355 is rated as 25.
How do I fix CVE-2026-53355?
To fix CVE-2026-53355, update the Linux Kernel to the latest version where the vulnerability has been resolved.
What systems are affected by CVE-2026-53355?
CVE-2026-53355 affects systems running vulnerable versions of the Linux Kernel that implement the RDS IB connection feature.
What does CVE-2026-53355 impact in the Linux Kernel?
CVE-2026-53355 impacts the RDS IB connection teardown path, which may lead to potential issues during partial startups or shutdowns.
When was CVE-2026-53355 published?
CVE-2026-53355 was published on July 1, 2026.