CVE-2026-98252: RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: fix refcount bug in iwpmgetnlmsgrequest()
iwpmgetnlmsgrequest() initializes refcount after listaddtail() making it accessible to global list where another CPU can krefget() on nlmsgrequest causing a refcount "addition on 0" bug. Fix this by initializing kref before listaddtail() so refcount for nlmsgrequest can be incremented/decremented normally. In addition, also initialize every field before listaddtail().
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required, but exploitation has high attack complexity.
What security impact could successful exploitation have?
The CVSS vector rates confidentiality, integrity, and availability impact as high. The scope is unchanged.
What is the underlying failure condition?
A request object is added to a global list before its reference count and other fields are initialized. Another CPU can access the object through that list and increment a zero reference count, triggering a refcount error.