UBUNTU-CVE-2026-98359: High severity ubuntu/linux-azure vulnerability
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Reject unregistering netdevs in ibgetethspeed ibdevicegetnetdev() intentionally returns a referenced netdevice even when it is unregistering, so matching and cleanup callers can still find the association. The reference keeps struct netdevice allocated, but does not guarantee that the device remains operational. ibgetethspeed() uses the returned device operationally by invoking its ethtool callback. Although that call is made under RTNL, the function does not verify the registration state first. An asynchronous RDMA port query can therefore call into a netdev after NETDEVUNREGISTER and ndouninit have completed. Check for NETREGREGISTERED while holding RTNL and return -ENODEV for a device which is being unregistered. Keeping RTNL across the check and the ethtool operation prevents unregister from starting between them. Keep the speed fallback and warning under RTNL as well, so the warning can safely read netdev->name. Drop the netdev reference before releasing RTNL once all accesses to the device are complete.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ib_get_eth_speed(), hold RTNL while checking for NETREG_REGISTERED and while performing the ethtool operation; return -ENODEV if the netdev is being unregistered, keep the speed fallback and warning under RTNL, and drop the netdev reference before releasing RTNL after all device accesses are complete.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the listed Ubuntu Linux kernel packages are potentially affected when they use RDMA and have RDMA ports associated with Ethernet network devices. The vulnerable path involves asynchronous RDMA port queries during network-device removal.
What conditions are required to trigger the flaw?
An attacker or local actor needs the ability to cause or race an asynchronous RDMA port query with Ethernet netdevice unregistration. The problematic query must reach ib_get_eth_speed() after NETDEV_UNREGISTER and ndo_uninit have completed.
Is an affected network device still usable during the vulnerable window?
No. The kernel may retain a reference to the net_device, keeping its structure allocated, but that does not mean the device remains operational. The vulnerable code could invoke the device's ethtool callback without confirming that it was still registered.
What behavior does the fix introduce?
The fix checks that the netdevice is NETREG_REGISTERED while RTNL is held and returns -ENODEV if unregistration is in progress. It keeps RTNL held through the ethtool operation so unregistration cannot begin during that access.