CVE-2026-97491 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
net/rds: Don't sleep inside rds_ib_conn_path_shutdown
New rds rdma self tests exposed a hang when tearing down the ib network configs. This is caused by the shutdown worker thread sleeping on the wait_event call, which blocks other work items in the queue. Fix this by changing wait_event to wait_event timeout, and looping until the wait check succeeds.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel's Reliable Datagram Sockets (RDS) implementation over InfiniBand contains a concurrency flaw within the connection path shutdown mechanism that can lead to system hangs during network configuration teardown operations. This vulnerability was identified through new RDS RDMA self-tests which exposed scenarios where the ib network configurations were being torn down, resulting in unresponsive behavior. The root cause lies in the rds_ib_conn_path_shutdown function, specifically within its worker thread execution context. During this process, the code invokes a wait_event call to synchronize state changes or resource release. However, executing sleepable operations such as wait_event inside certain kernel contexts that are already holding locks or operating under specific scheduling constraints can block other work items queued for processing. This blocking effect creates a deadlock-like scenario where critical cleanup tasks cannot proceed because they are waiting on the hung worker thread, which in turn is stuck waiting for an event that may never trigger due to the blocked execution flow.
From a technical perspective, this issue represents a violation of proper kernel synchronization practices regarding sleeping within atomic or restricted contexts. The original implementation relied on wait_event without a timeout mechanism, assuming that the awaited condition would eventually be met by other asynchronous processes. When those dependent processes are themselves stalled because they cannot run due to queue blocking, the system enters a permanent stall state. This is particularly problematic in high-performance computing environments where RDS and InfiniBand are commonly deployed for low-latency communication between nodes. The inability to cleanly shut down connection paths can lead to resource leaks, stale network states, and potential denial of service conditions if multiple such shutdowns occur concurrently or under heavy load.
The operational impact of this vulnerability includes system instability during routine maintenance tasks involving network interface reconfiguration or teardown. Administrators performing these operations may find that the kernel becomes unresponsive, requiring a hard reboot to restore functionality. This affects availability and reliability, which are critical for enterprise infrastructure relying on RDS for data transfer between cluster nodes. The flaw does not appear to be exploitable by remote attackers for code execution but poses a significant risk to system stability when triggered by local actions or automated scripts managing network interfaces.
To mitigate this vulnerability, the fix involves modifying the wait_event call within rds_ib_conn_path_shutdown to use wait_event_timeout instead. This change ensures that the worker thread does not sleep indefinitely if the expected condition is not met promptly. By implementing a timeout and looping until the wait check succeeds or times out appropriately, the code prevents indefinite blocking of other work items in the queue. This allows the shutdown process to proceed even if some resources are slow to release, thereby maintaining system responsiveness. System administrators should ensure that their Linux kernels are updated with patches addressing this specific RDS InfiniBand issue. For environments running affected kernel versions, applying the latest security and stability updates is essential to prevent potential hangs during network management operations.
This vulnerability aligns with CWE-835, which describes a loop involving an uncontrolled resource consumption that can lead to denial of service through blocking or hanging processes. It also relates to ATT&CK technique T1496, Resource Hijacking, specifically in the context of CPU and execution time hijacking via kernel-level deadlocks. While not typically classified as a direct attack vector for privilege escalation, its impact on system availability makes it a critical concern for infrastructure integrity. Proper handling of synchronization primitives is vital to maintain the robustness of network stack components within the Linux kernel.