Vulnerability · CVE-2026-99212
CVE-2026-99212: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
Published Oct 28, 2026 · catalog updated Oct 31, 2026 · Linux Linux
Last checked Nov 4, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-99212. EPSS is 0.12%. Act only if a listed version of Linux Linux is installed.
Gaps on this record
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
Same product and reporting
- CVE-2026-99260 · Medium
- CVE-2026-99259 · Medium
- CVE-2026-99258 · High
- CVE-2026-99257 · Medium
- CVE-2026-99255 · Medium
- Severity
- Medium—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.12%
- Remediation
- Advisory link
- Affected products
- Linux Kernel · linux kernel · vendor Linux Linux
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE route with no usable device - makes addr_handler() destroy the id the event was delivered on. That id is ic->i_cm_id, and nothing clears the pointer: the connection sits in RDS_CONN_CONNECTING with a freed id until its shutdown calls rdma_disconnect() and rdma_destroy_id() on it. The ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect() forces a zero return while ic->i_cm_id == cm_id, as the comment there explains. Do the same here - drop the connection and return 0 - so the id stays RDS's to destroy from the shutdown, and the reconnect gets a fresh one.
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Linux Kernel2.6.30 → 5.15.224; 5.16.0 → 6.1.191; 6.2.0 → 6.6.161
- Linux Kernel2.6.30 → 6.18.59; 6.19.0 → 7.2.13
- linux kernelversion unspecified
- vendor Linux Linuxversion unspecified
How to fix CVE-2026-99212
Upgrade
CVE-2026-99212 lists a fix boundary at 5.15.224. Compare the installed build with that boundary before you change production.
Version check
Seen in 2.6.30 → 5.15.224; 5.16.0 → 6.1.191; 6.2.0 → 6.6.161 · 1 other packages on the advisory
Advisory
Open the bsi record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-99212. EPSS is 0.12%. Act only if a listed version of Linux Linux is installed.
Which versions are affected?
Compare what you have installed with Kernel 2.6.30 → 5.15.224; 5.16.0 → 6.1.191; 6.2.0 → 6.6.161; Kernel 2.6.30 → 6.18.59; 6.19.0 → 7.2.13. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
No weakness class is stored. EPSS 0.12%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 28, 2026 · Tenable CVE Database
Detected
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE rou
Oct 28, 2026 · CVE.org
Updated
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE rou
Oct 29, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 6.18.59; Kernel fixed in 7.2.13
Oct 29, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 6.18.59; 6.19.0
Oct 29, 2026 · OpenSSF OSV / OSV Scanner
Updated
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE rou
Oct 31, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 5.15.224; Kernel fixed in 6.1.191; Kernel fixed in 6.6.161; Kernel fixed in 6.12.115
Oct 31, 2026 · OpenSSF OSV / OSV Scanner
Fix available
Kernel fixed in 5.15.224; 5.16.0
Oct 31, 2026 · OpenSSF OSV / OSV Scanner
Updated
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE rou
Sources
- BSI CERT-BundGovernment advisoryCVE-2026-99212
Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
wid.cert-bund.de - CVE.orgVulnerability recordCVE-2026-99212
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOL
cve.org - FIRST EPSSExploitation probabilityCVE-2026-99212
30-day exploitation probability 0.12%
first.org - Linux Kernel CVEVendor advisoryCVE-2026-99212
From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straigh
git.kernel.org - OpenSSF OSV / OSV ScannerPackage advisoryCVE-2026-99212
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
osv.dev - Tenable CVE DatabaseVulnerability recordCVE-2026-99212
In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure rds_rdma_cm_event_handler_cmn() hands the return value of rdma_resolve_route() straight back to the rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE rou
tenable.com
References
Freshness
Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 4, 2026
- OpenSSF OSV / OSV ScannerOct 31, 2026
- BSI CERT-BundOct 30, 2026
- CVE.orgOct 28, 2026
- Linux Kernel CVEOct 28, 2026
- Tenable CVE DatabaseOct 28, 2026