{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "1422f28826d2a0c11e5240b3e951c9e214d8656e"
            },
            {
              "fixed": "ed7ee0cd0e136d02f87f13181b1a89880463c7e9"
            },
            {
              "fixed": "a269795107f45adc95975a83324f8fef40bec4ce"
            },
            {
              "fixed": "3764627b30a283e611e652c4a2bb8cdc74a75a99"
            },
            {
              "fixed": "6d0c8b7073913011459cf968cbbadd341e166bc3"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "bec6c4ce1169a565c58c347d5d0ac22e46d507d6"
            },
            {
              "last_affected": "f781fb5177cdfd9a6c98cd94e30275457c6461ac"
            },
            {
              "last_affected": "1e1e4316fcaeb9cd6bc56c91127e88625237dd44"
            },
            {
              "last_affected": "8c378cc522aedd5fa5aa53486b43a4d552fbbd5c"
            },
            {
              "last_affected": "52287ed416a10bc3d3e204a3186d9509ab3ee634"
            },
            {
              "last_affected": "4a4dffdff9ea6201665f5d0a5042011d09bd527f"
            },
            {
              "last_affected": "917135195200e20e5244b9c3f2bb40f3d5e02510"
            },
            {
              "last_affected": "d792459a6e2ae21c7f5107babd63e52e4c5ab93a"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "4.19.311"
            },
            {
              "fixed": "4.20"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.4.273"
            },
            {
              "fixed": "5.5"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.10.214"
            },
            {
              "fixed": "5.11"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "5.15.153"
            },
            {
              "fixed": "5.16"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.1.83"
            },
            {
              "fixed": "6.2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.6.23"
            },
            {
              "fixed": "6.7"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.7.11"
            },
            {
              "fixed": "6.8"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.8.2"
            },
            {
              "fixed": "6.9"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.9.0"
            },
            {
              "fixed": "6.12.111"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.53"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98072.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: use wq_has_sleeper() in release_in_xmit()\n\nrelease_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then\nchecks waitqueue_active() to decide whether anyone needs waking.\nclear_bit_unlock() is only a release operation: it orders the\ncritical section before the bit clear, but does not order the\nsubsequent plain load of the wait queue head after it.  The waiter\nside does the mirror image - it adds itself to the wait queue and\nthen tests the bit.  That is the classic store-buffering pattern: the\nreleasing CPU can read the wait queue as empty while the waiting CPU\nstill reads the bit as set, so the sleeper is never woken.\n\nThe waiters are rds_conn_shutdown() and rds_tcp_reset_callbacks(),\nboth in uninterruptible wait_event() with no timeout.  A lost wake-up\nstrands the shutdown worker on its single-threaded workqueue until\nsome other sender releases the bit again - and on a connection that\nis being torn down precisely because it failed, there may never be\nanother sender.\n\nThe barrier used to be there: release_in_xmit() did clear_bit()\nfollowed by smp_mb__after_atomic() until commit 1422f28826d2 (\"rds:\nintroduce acquire/release ordering in acquire/release_in_xmit()\")\nfolded both into clear_bit_unlock(), which strengthened the lock\nhand-off but silently dropped the full barrier the wake-up check\ndepends on.  The refill counterpart, release_refill() in\nnet/rds/ib_recv.c, still carries its smp_mb__after_atomic() for\nexactly this reason.\n\nUse wq_has_sleeper(), which is waitqueue_active() preceded by the\nrequired full barrier.",
  "id": "CVE-2026-98072",
  "modified": "2026-09-27T03:30:30.584803165Z",
  "published": "2026-09-25T10:24:12.675Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3764627b30a283e611e652c4a2bb8cdc74a75a99"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d0c8b7073913011459cf968cbbadd341e166bc3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a269795107f45adc95975a83324f8fef40bec4ce"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ed7ee0cd0e136d02f87f13181b1a89880463c7e9"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98072.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98072"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "net/rds: use wq_has_sleeper() in release_in_xmit()"
}