CVE-2026-98431: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98431 is a circular locking dependency (ABBA deadlock) vulnerability in the Linux kernel's RDMA/uverbs subsystem. It was introduced by commit 51976c6cd786, which added disassociation_lock to protect mmap registrations against uverbs_user_mmap_disassociate(), but inadvertently created a deadlock between mmap_lock and disassociation_lock. Affected kernel versions include 6.11.11 through pre-6.12 and 6.12.2 through pre-6.13, as well as kernel 6.13. The vulnerability was published on October 14, 2026, with a patch available on the same date. The estimated CVSS severity is Medium (GitHub Advisory).

The root cause is a classic ABBA deadlock (CWE-667: Improper Locking) in the Linux kernel RDMA/uverbs subsystem. Thread A (handling mmap/fork) acquires mmap_lock then attempts to acquire disassociation_lock, while Thread B (handling disassociation) acquires disassociation_lock then attempts to acquire mmap_lock, creating a circular dependency that freezes both threads. The fix removes disassociation_lock entirely and reuses the pre-existing hw_destroy_rwsem, with down_read_trylock() used in mmap paths to avoid blocking while mmap_lock is already held. A lockdep warning in kernel 6.18.0 confirmed the circular dependency chain involving rdma_umap_open(), ib_uverbs_mmap(), and uverbs_user_mmap_disassociate() (GitHub Advisory).

Successful exploitation causes a kernel hang affecting the threads involved in concurrent mmap and RDMA disassociation operations, resulting in a local denial of service. A local user with access to RDMA user verbs operations can freeze affected threads, potentially rendering RDMA-dependent services or the entire system unresponsive. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. Exploitation requires local access to a system with RDMA user verbs operations available, limiting the attack surface to environments with InfiniBand or RDMA-capable hardware. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score data is currently available (GitHub Advisory).

• Logs: Kernel log entries containing WARNING: possible circular locking dependency detected referencing mmap_lock and disassociation_lock in the ib_uverbs module; lockdep traces involving uverbs_user_mmap_disassociate, rdma_umap_open, or ib_uverbs_mmap.
• Process Behavior: Threads in uninterruptible sleep (D state) associated with RDMA/uverbs operations or processes performing mmap/fork on RDMA-mapped memory; system becoming unresponsive to RDMA-related operations.

Apply the kernel patches fixing the circular dependency: commit 426f54f20b79c5b164a0472ad3f6ba36afcd08c6 (for the 6.11.x–6.12 range) and commit a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236 (for the 6.12.x–6.13 range), both available via the stable kernel tree. Update affected Linux kernel versions (6.11.11 through 6.12.x and 6.12.2 through 6.13) to patched releases. As a temporary workaround where patching is not immediately possible, restrict local user access to RDMA user verbs operations (GitHub Advisory).