CVE-2026-99212: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99212 is a use-after-free vulnerability in the Linux kernel's net/rds (Reliable Datagram Sockets) RDMA subsystem, introduced as far back as kernel version 2.6.30. The flaw exists in rds_rdma_cm_event_handler_cmn(), which incorrectly propagates a synchronous failure return value from rdma_resolve_route() back to the rdma_cm layer on RDMA_CM_EVENT_ADDR_RESOLVED, causing the rdma_cm to destroy a connection ID (ic->i_cm_id) that RDS still owns. The vulnerability was published on October 28, 2026, with patches available for stable kernel branches. The CVSS base score is listed as 0.0 (unscored) with an estimated medium severity (GitHub Advisory, Feedly).

The root cause is improper resource management (CWE class: use-after-free) in the RDS RDMA connection manager event handler. When rdma_resolve_route() fails synchronously — due to -ENOMEM from route work allocation, an SA query setup failure, or a RoCE route with no usable device — the return value is passed directly back to the rdma_cm, which then calls addr_handler() to destroy the connection ID. Because ic->i_cm_id is never cleared after this destruction, the connection remains in RDS_CONN_CONNECTING state holding a dangling pointer to the freed ID. The fix mirrors the existing safe pattern in the ROUTE_RESOLVED case (rds_ib_cm_initiate_connect()): drop the connection and return 0 so that RDS retains ownership of the ID for proper cleanup during shutdown (GitHub Advisory).

Successful exploitation can cause a kernel crash or undefined behavior due to use-after-free conditions when the freed connection ID is accessed during RDS connection shutdown (via rdma_disconnect() and rdma_destroy_id()). The primary impact is a denial of service affecting the availability of the host system. The vulnerability is locally exploitable and does not directly expose confidential data or allow privilege escalation, though kernel instability could indirectly affect all services running on the affected host (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to trigger RDS RDMA connection failures, such as through memory exhaustion, specific network conditions, or device unavailability.

Patches have been committed to the Linux kernel stable trees. Fixed commits are available at: a7c7d0ff876377fea7ae876a28d6df8d9349df57 (one stable branch), 91ece3efa064f0b3b3c67b9b045d9eeb4a034e43, and 98d446b7c013254a8a7b49720557676a3a851fde. Unaffected versions include Linux kernel 6.18.59 and later (within the 6.18.x series), 7.2.13 and later (within the 7.2.x series), and 7.3 and above. Administrators should update to a patched kernel version provided by their Linux distribution. As a short-term workaround where RDS over RDMA is not required, disabling the rds kernel module (modprobe -r rds) can eliminate exposure (GitHub Advisory, Feedly).