CVE-2026-98560: net/rds: size a connection's path set by the transport it ends up with

In the Linux kernel, the following vulnerability has been resolved:

net/rds: size a connection's path set by the transport it ends up with

rdsconncreate() computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the loopback transport instead. That substitution is what an RDS/TCP socket sending to a local address gets, and after it the path init loop still runs for the TCP transport's RDSMPATHWORKERS paths and allocates an ordered workqueue for each, while rdsloopconnalloc() only ever provides transport data for path 0.

rdsconndestroy() sizes its teardown from ctrans, by then the loopback transport, so it visits path 0 only - and rdsconnpathdestroy() would skip the other paths anyway, since it returns before destroyworkqueue() for a path without transport data. kfree(cpath) then drops the last pointers to seven workqueues. That repeats for every such connection, on every netns teardown or module unload, and every distinct local destination address is a separate connection.

Recompute npaths once the transport is final, so that creation and destruction agree on the set of paths. The cpath array stays sized for the caller's transport; the unused entries are freed with it.