Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99166— net: rds: fix uninitialized trans dereference in CM event handler

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： net: rds: 修复 CM 事件处理程序中对未初始化的解引用问题函数仅在 RDMA 设备为 InfiniBand CA（即）时才会对进行赋值。对于其他类型的设备（例如 iWARP RNIC，如），将保持未初始化状态，但事件切换逻辑却会无条件地解引用该变量：在情况下，通过无条件访问；在和情况下（需具备连接上下文），也会对其进行访问。因此，运行在 iWARP 设备上的 RDS 监听器在收到连接请求时，会立即导致内核崩溃：若启用了配置，该非法读取将

AI Predicted 7.8 Difficulty: Moderate Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1499 · Endpoint Denial of Service

Affected Version Matrix 8

Vendor	Product	Version Range	Status
Linux	Linux	`dcdede0406d30e14a6ed727dce69dfac0518371d< 5f23e4e3a31dacfd82a8f56be253adc0910ee84f`	affected
		`dcdede0406d30e14a6ed727dce69dfac0518371d< ca14c289ed9ffed6cc64290d039e923e5720a8bf`	affected
		`dcdede0406d30e14a6ed727dce69dfac0518371d< 492ba6ac1b1ffb8a06ff52db0825c1af2cdb28c8`	affected
		`4.6`	affected
		`< 4.6`	unaffected
		`6.18.59≤ 6.18.*`	unaffected
		`7.2.13≤ 7.2.*`	unaffected
		`7.3≤ *`	unaffected

Updated Oct 28, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

net: rds: fix uninitialized trans dereference in CM event handler

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but the event switch dereferences it: unconditionally in the RDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(), and (with a connection context) in the ROUTE_RESOLVED and ESTABLISHED cases. An RDS listener on an iWARP device therefore crashes the kernel as soon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO the wild load becomes a NULL dereference at offset 0xa0 (&trans->cm_handle_connect) in the iw_cm_wq workqueue. GCC masks the bug in default builds by folding the uninitialized load into &rds_ib_transport; Clang-built kernels take the real uninitialized path and oops. The active side can land on a non-IB device too: the id that rds_ib_conn_path_connect() creates is not restricted to a node type, so rdma_resolve_addr() binds it to whichever device serves the local address, and an iWARP RNIC on the same netdev qualifies. The crash there is different: resolving a route on an iWARP id never fills in cm_id->route.path_rec, and the ROUTE_RESOLVED case writes path_rec[0].sl before it calls into the transport. The iWARP transport was dropped long ago and IB is the only transport left, so make that explicit: initialize trans to &rds_ib_transport at declaration, drop the conditional assignment, reject a connect request that arrives on a non-IB device, and drop a connection whose address resolved to one instead of resolving a route on it. The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUEST on purpose: a non-zero return from the handler makes rdma_cm destroy the id the event was delivered on, which is right for the request's freshly created id but would free a connection id that RDS still owns for any other event. On the active side the id stays ic->i_cm_id and the connection's shutdown destroys it, so that case returns 0. [achender: reject only on RDMA_CM_EVENT_CONNECT_REQUEST instead of bailing out for every event on a non-IB device, so that rdma_cm does not destroy connection ids RDS still tracks; drop a connection whose address resolved to a non-IB device before a route is resolved on it; changelog adjusted]

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	dcdede0406d30e14a6ed727dce69dfac0518371d ~ 5f23e4e3a31dacfd82a8f56be253adc0910ee84f	-
Linux	Linux	4.6	-

II. Public POCs for CVE-2026-99166

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99166

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99166 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99166

Same Patch Batch · Linux · 2026-10-28 · 117 CVEs total

CVE-2026-99143		tracing: Keep the predicate limit separate from program capacity
CVE-2026-99129		selinux: fix BPF token permission checks
CVE-2026-99130		io_uring/cancel: don't spin on local work the task can't run
CVE-2026-99131		xfs: fix capability check in xfs
CVE-2026-99133		net/iucv: fix the recvmsg window update
CVE-2026-99132		xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
CVE-2026-99134		mac802154: fix data race and NULL deref on local->assoc_dev
CVE-2026-99135		dm-integrity: fix infinite loop on discard with large tag size
CVE-2026-99137		cifs: don't update i_size in cifs_do_truncate without a cached handle
CVE-2026-99136		dm-crypt: fix a tiny race condition in crypt_dec_pending
CVE-2026-99138		tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
CVE-2026-99140		tracing: Fix hist trigger timestamps for buffered events
CVE-2026-99139		tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
CVE-2026-99141		tracing: Fix crash in print_graph_function_event()
CVE-2026-99142		tracing: Check operator stack capacity before pushing
CVE-2026-99154		scsi: libiscsi: Reject a negative task index from parse_pdu_itt
CVE-2026-99151		drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
CVE-2026-99153		scsi: libiscsi: Validate the ITT reflected in a Reject PDU
CVE-2026-99152		scsi: libiscsi: Validate the task named by a management response
CVE-2026-99150		drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

Showing top 20 of 117 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux