# CVE-2026-98069: net/rds: acquire the fastpath locks in rds_conn_shutdown() CVE-2026-98069 is fixed in 58 products on 1 platform, first by DEBIAN-CVE-2026-98069, released September 29, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-98069 - Priority: High - CVSS: 8.1 (Important) - EPSS: 0.0056 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Sep 25, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98069 ## Description In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rds_conn_shutdown() rds_conn_shutdown() quiesces the transmit and receive-refill paths by waiting for RDS_IN_XMIT and RDS_RECV_REFILL to be sampled clear, and then runs the transport shutdown and rds_conn_path_reset(). Sampling the bits clear is not the same as owning them: the moment after the wait_event() returns, rds_send_xmit() can re-acquire RDS_IN_XMIT (or rds_ib_recv_refill() can re-acquire RDS_RECV_REFILL) and run concurrently with the teardown. The sender does recheck the connection state after taking the lock, but that recheck is a classic store-buffering pattern: teardown writes the state and reads the bit while the sender writes the bit and reads the state. acquire_in_xmit() is only an acquire operation, so on weakly ordered architectures both sides can miss each other's write, and the transmit path then runs while the transport zeroes its rings (e.g. rds_ib_ring_init()) and rds_send_path_reset() rewrites the transmit state under it. Oracle UEK fixed the same class of crashes - a 14-year tail of BUG_ON()s in rds_ib_sub_signaled(), unexpected op-codes and NULL dereferences in rds_ib_send_cqe_handler() during failover testing - by making the teardown path *acquire* the fastpath bit locks instead of testing them ("rds: Make sure transmit path and connection tear-down does not run concurrently"). Ownership of a single word is decided by RMW atomicity, so no cross-variable ordering is needed. Do the same here: take both locks before calling the transport shutdown, hold them across rds_conn_path_reset(), and release them explicitly with a wake-up afterwards. Both are released with clear_bit_unlock(), so that the ring re-initialization done by the transport shutdown and the transmit state rewritten by rds_send_path_reset() are ordered before either bit is seen clear by the next acquire_in_xmit() or acquire_refill(). The fastpath users of these bits - rds_send_xmit() and rds_ib_recv_refill() - are trylock style and back off while teardown owns the locks, so no new lock dependency is introduced for them. rds_tcp_reset_callbacks() is different: since the previous patch it acquires RDS_IN_XMIT as well, and it blocks doing so, so its wait now spans the teardown instead of at most one send batch. That waiter runs from rds_tcp_accept_one() on the single-threaded krdsd workqueue and holds rds_tcp_accept_lock and t_conn_path_lock while it waits, so a duelling SYN accepted while its path is being torn down parks accept processing for the duration of the teardown - for TCP bounded by the (up to 5 s) drain loop in rds_tcp_conn_path_shutdown(). An IB path's drain in rds_ib_conn_path_shutdown() has no round cap, but no blocking waiter either: rds_tcp_reset_callbacks() is the only blocking acquirer of these bits and waits only on its own TCP path, and the fastpaths are trylock-and-back-off on both transports, so a long IB drain lengthens only that path's own quiesce. The window is narrow: the accept-side state check has to pass before the teardown moves the path to RDS_CONN_DISCONNECTING. Because krdsd is a single global workqueue, everything else queued there - accept processing for other connections and network namespaces, and the flush_workqueue(rds_wq) in rds_tcp_listen_stop() during namespace teardown - waits behind the parked accept worker for that time. It cannot deadlock, although the waits do point at each other: the teardown blocks until the bit's holder releases it, and the holder may be that krdsd accept worker. The holder finishes without needing anything the teardown owns: the sync cancels rds_tcp_reset_callbacks() issues target cp_send_w and cp_recv_w on the path's ordered cp_wq, whose only execution slot is occupied by the blocked cp_down_w itself, so they are pending at most and cancel without flushing - a reliance on cp_wq being ordered that is now noted next to those cancels (on ---truncated--- ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | bpftool-debuginfo amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | bpftool6.12 amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | bpftool6.12-debuginfo amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | bpftool6.18 amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | bpftool6.18-debuginfo amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-debuginfo amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-debuginfo-common-aarch64 amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-debuginfo-common-x86_64 amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-devel amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-headers amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-livepatch-6.1.189-236.399 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-livepatch-6.12.111-136.204 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel-livepatch-6.18.54-121.166 amzn 2023 | 1:1.0-0.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel-modules-extra amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-modules-extra-common amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-tools amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-tools-debuginfo amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel-tools-devel amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | kernel6.12 amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-debuginfo amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-debuginfo-common-aarch64 amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-debuginfo-common-x86_64 amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-devel amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-headers amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-modules-extra amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-modules-extra-common amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-tools amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-tools-debuginfo amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.12-tools-devel amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | kernel6.18 amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-debuginfo amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-debuginfo-common-aarch64 amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-debuginfo-common-x86_64 amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-devel amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-headers amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-modules-extra amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-modules-extra-common amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-tools amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-tools-debuginfo amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | kernel6.18-tools-devel amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | linux Debian 12.15 (bookworm) | 6.1.190-1 | [DEBIAN-CVE-2026-98069](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98069.md) | Sep 29, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.111-1 | [DEBIAN-CVE-2026-98069](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98069.md) | Sep 29, 2026 | | Linux | linux Debian 14 | 7.2.7-1 | [DEBIAN-CVE-2026-98069](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98069.md) | Sep 29, 2026 | | Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.111-1~deb12u1 | [DEBIAN-CVE-2026-98069](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98069.md) | Sep 29, 2026 | | Linux | microvm-kernel amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | microvm-kernel6.18 amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | perf amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | perf-debuginfo amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | perf6.12 amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | perf6.12-debuginfo amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | perf6.18 amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | perf6.18-debuginfo amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | python3-perf amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | python3-perf-debuginfo amzn 2023 | 1:6.1.189-236.399.amzn2023 | [ALAS2023-2026-3336](https://patchblox.com/security/data/fix/linux/alas2023-2026-3336.md) | Nov 7, 2026 | | Linux | python3-perf6.12 amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | python3-perf6.12-debuginfo amzn 2023 | 1:6.12.111-136.204.amzn2023 | [ALAS2023-2026-3193](https://patchblox.com/security/data/fix/linux/alas2023-2026-3193.md) | Nov 7, 2026 | | Linux | python3-perf6.18 amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | | Linux | python3-perf6.18-debuginfo amzn 2023 | 1:6.18.54-121.166.amzn2023 | [ALAS2023-2026-3192](https://patchblox.com/security/data/fix/linux/alas2023-2026-3192.md) | Nov 7, 2026 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.