RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency Commit 51976c6cd786 ("RDMA/core: Provide rdma_user_mmap_disassociate() to disassociate mmap pages") introduced disassociation_lock to protect new mmap registrations against uverbs_user_mmap_disassociate(), but created an ABBA deadlock: Thread A (mmap / fork): mmap_lock -> disassociation_lock Thread B (disassociate): disassociation_lock -> mmap_lock Fix by removing disassociation_lock entirely and using the pre-existing hw_destroy_rwsem instead. hw_destroy_rwsem already provides the same protection: rdma_umap_open() and ib_uverbs_mmap() both use down_read_trylock() before registering a new VMA, so holding hw_destroy_rwsem in uverbs_user_mmap_disassociate() is sufficient to block new registrations. trylock is used in both mmap paths (not blocking down_read) because mmap_lock is already held on entry, and uverbs_user_mmap_disassociate() acquires mmap_lock internally — a blocking read would recreate the same deadlock. The only caller that was not taking hw_destroy_rwsem for write was rdma_user_mmap_disassociate(). Fix it to take the rwsem per-ufile while iterating under lists_mutex. This is safe because ib_uverbs_close() releases hw_destroy_rwsem entirely before acquiring lists_mutex, so the two locks are never held simultaneously. lockdep warning: [ 776.654252] ====================================================== [ 776.655214] WARNING: possible
CVE-2026-98431
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98431
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "51976c6cd786151b6a1bdf8b8b3334beac0ba99c",
"lessThan": "426f54f20b79c5b164a0472ad3f6ba36afcd08c6",
"versionType": "git"
},
{
"status": "affected",
"version": "51976c6cd786151b6a1bdf8b8b3334beac0ba99c",
"lessThan": "a44a3f175eaee7e5aeb6a8fed381c4a0d5f49236",
"versionType": "git"
},
{
"status": "affected",
"version": "0598914a950ddfa694f410e482453cdbb9265515",
"versionType": "git"
},
{
"status": "affected",
"version": "86092a4e46d161d24f8106df082e24b8efe87382",
"versionType": "git"
},
{
"status": "affected",
"version": "6.11.11",
"lessThan": "6.12",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.2",
"lessThan": "6.13",
"versionType": "semver"
}
],
"programFiles": [
"drivers/infiniband/core/rdma_core.c",
"drivers/infiniband/core/uverbs_main.c",
"include/rdma/uverbs_types.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.13",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/infiniband/core/rdma_core.c",
"drivers/infiniband/core/uverbs_main.c",
"include/rdma/uverbs_types.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98431
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38495 · Revision 1
- Added to Heist Feed
- Publisher date