Skip to content
Fencer Vulns
critical 9.8

CVE-2026-45898 in the critical feed json

RDMA/iwcm: Fix workqueue list corruption by removing work_list

published 2026-05-27 5 mo ago modified 2026-10-19 20 d ago also EUVD-2026-32364

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

RDMA/iwcm: Fix workqueue list corruption by removing work_list

The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") changed the work submission logic to unconditionally call queue_work() with the expectation that queue_work() would have no effect if work was already pending. The problem is that a free list of struct iwcm_work is used (for which struct work_struct is embedded), so each call to queue_work() is basically unique and therefore does indeed queue the work.

This causes a problem in the work handler which walks the work_list until it's empty to process entries. This means that a single run of the work handler could process item N+1 and release it back to the free list while the actual workqueue entry is still queued. It could then get reused (INIT_WORK...) and lead to list corruption in the workqueue logic.

Fix this by just removing the work_list. The workqueue already does this for us.

This fixes the following error that was observed when stress testing with ucmatose on an Intel E830 in iWARP mode:

[ 151.465780] list_del corruption. next->prev should be ffff9f0915c69c08, but was ffff9f0a1116be08. (next=ffff9f0a15b11c08) [ 151.466639] ------------[ cut here ]------------ [ 151.466986] kernel BUG at lib/list_debug.c:67! [ 151.467349] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 151.467753] CPU: 14 UID: 0 PID: 2306 Comm: kworker/u64:18 Not tainted 6.19.0-rc4+ #1 PREEMPT(voluntary) [ 151.468466] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 151.469192] Workqueue: 0x0 (iw_cm_wq) [ 151.469478] RIP: 0010:__list_del_entry_valid_or_report+0xf0/0x100 [ 151.469942] Code: c7 58 5f 4c b2 e8 10 50 aa ff 0f 0b 48 89 ef e8 36 57 cb ff 48 8b 55 08 48 89 e9 48 89 de 48 c7 c7 a8 5f 4c b2 e8 f0 4f aa ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 [ 151.471323] RSP: 0000:ffffb15644e7bd68 EFLAGS: 00010046 [ 151.471712] RAX: 000000000000006d RBX: ffff9f0915c69c08 RCX: 0000000000000027 [ 151.472243] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f0a37d9c600 [ 151.472768] RBP: ffff9f0a15b11c08 R08: 0000000000000000 R09: c0000000ffff7fff [ 151.473294] R10: 0000000000000001 R11: ffffb15644e7bba8 R12: ffff9f092339ee68 [ 151.473817] R13: ffff9f0900059c28 R14: ffff9f092339ee78 R15: 0000000000000000 [ 151.474344] FS: 0000000000000000(0000) GS:ffff9f0a847b5000(0000) knlGS:0000000000000000 [ 151.474934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 151.475362] CR2: 0000559e233a9088 CR3: 000000020296b004 CR4: 0000000000770ef0 [ 151.475895] PKRU: 55555554 [ 151.476118] Call Trace: [ 151.476331] <TASK> [ 151.476497] move_linked_works+0x49/0xa0 [ 151.476792] __pwq_activate_work.isra.46+0x2f/0xa0 [ 151.477151] pwq_dec_nr_in_flight+0x1e0/0x2f0 [ 151.477479] process_scheduled_works+0x1c8/0x410 [ 151.477823] worker_thread+0x125/0x260 [ 151.478108] ? __pfx_worker_thread+0x10/0x10 [ 151.478430] kthread+0xfe/0x240 [ 151.478671] ? __pfx_kthread+0x10/0x10 [ 151.478955] ? __pfx_kthread+0x10/0x10 [ 151.479240] ret_from_fork+0x208/0x270 [ 151.479523] ? __pfx_kthread+0x10/0x10 [ 151.479806] ret_from_fork_asm+0x1a/0x30 [ 151.480103] </TASK>

Patch / fix

  • Linux Linux 6.12.75, 6.18.14, 6.19.4, 7.0
  • Red Hat Red Hat Enterprise Linux 10 0:6.12.0-211.28.1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:6.12.0-55.82.1.el10_0
  • Red Hat Red Hat Enterprise Linux 9 0:5.14.0-687.19.1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:5.14.0-570.123.1.el9_6
  • linux Debian 13 6.12.85-1
  • linux Debian 14 6.18.14-1

debian advisories DEBIAN-CVE-2026-45898

  • linux Ubuntu 25.10 6.17.0-40.40
  • linux-aws Ubuntu 25.10 6.17.0-1019.19
  • linux-gcp Ubuntu 25.10 6.17.0-1020.22
  • linux-raspi Ubuntu 25.10 6.17.0-1021.21
  • linux-riscv Ubuntu 25.10 6.17.0-40.40.1
  • linux-oracle Ubuntu 25.10 6.17.0-1018.18
  • linux-aws-6.17 Ubuntu 24.04 LTS 6.17.0-1019.19~24.04.1
  • linux-gcp-6.17 Ubuntu 24.04 LTS 6.17.0-1020.22~24.04.1

ubuntu advisories UBUNTU-CVE-2026-45898

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-687.19.1.el9_8
  • rv RHEL 9 5.14.0-687.19.1.el9_8
  • perf RHEL 9 5.14.0-687.19.1.el9_8
  • rtla RHEL 9 5.14.0-687.19.1.el9_8
  • libperf RHEL 9 5.14.0-687.19.1.el9_8
  • kernel-rt RHEL 9 5.14.0-687.19.1.el9_8
  • kernel-64k RHEL 9 5.14.0-687.19.1.el9_8
  • kernel-core RHEL 9 5.14.0-687.19.1.el9_8

red hat advisories RHSA-2026:30848RHSA-2026:30129RHSA-2026:27731RHSA-2026:27708

  • kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.59.2
  • kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.59.1
  • kernel-source-rt Real Time Module 15 SP7 6.4.0-150700.7.59.2
  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.60.1
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.60.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.60.1
  • kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.60.1
  • kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.60.1

suse advisories SUSE-SU-2026:2591-1SUSE-SU-2026:2482-1SUSE-SU-2026:22112-1SUSE-SU-2026:22127-1SUSE-SU-2026:22117-1SUSE-SU-2026:22099-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.35.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.35.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.35.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.35.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.35.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.35.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.35.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.35.1

opensuse advisories openSUSE-SU-2026:20965-1

  • kernel AlmaLinux 9 5.14.0-687.19.1.el9_8
  • rv AlmaLinux 9 5.14.0-687.19.1.el9_8
  • perf AlmaLinux 9 5.14.0-687.19.1.el9_8
  • rtla AlmaLinux 9 5.14.0-687.19.1.el9_8
  • libperf AlmaLinux 9 5.14.0-687.19.1.el9_8
  • kernel-rt AlmaLinux 9 5.14.0-687.19.1.el9_8
  • kernel-64k AlmaLinux 9 5.14.0-687.19.1.el9_8
  • kernel-core AlmaLinux 9 5.14.0-687.19.1.el9_8

almalinux advisories ALSA-2026:30848ALSA-2026:30129

  • kernel Rocky Linux 10 6.12.0-211.28.1.el10_2

rocky linux advisories RLSA-2026:30129

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45898 updated cvss 7.0

kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list

  • Red Hat CodeReady Linux Builder EUS (v.9.6) libperf 5.14.0-570.123.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.123.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.123.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.123.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.123.1.el9_6
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.19.1.el9_8, perf 5.14.0-687.19.1.el9_8, rtla 5.14.0-687.19.1.el9_8, python3-perf 5.14.0-687.19.1.el9_8, kernel-devel-matched 5.14.0-687.19.1.el9_8, kernel-64k-devel-matched 5.14.0-687.19.1.el9_8, +7 more
    fixed: vendor fix RHSA-2026:30848
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.28.1.el10_2, perf 6.12.0-211.28.1.el10_2, rtla 6.12.0-211.28.1.el10_2, python3-perf 6.12.0-211.28.1.el10_2, kernel-devel-matched 6.12.0-211.28.1.el10_2, kernel-64k-devel-matched 6.12.0-211.28.1.el10_2, +7 more
    fixed: vendor fix RHSA-2026:30129
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) rv 6.12.0-55.82.1.el10_0, perf 6.12.0-55.82.1.el10_0, rtla 6.12.0-55.82.1.el10_0, python3-perf 6.12.0-55.82.1.el10_0, kernel-devel-matched 6.12.0-55.82.1.el10_0, kernel-64k-devel-matched 6.12.0-55.82.1.el10_0, +7 more
    fixed: vendor fix RHSA-2026:27731
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) rv 5.14.0-570.123.1.el9_6, perf 5.14.0-570.123.1.el9_6, rtla 5.14.0-570.123.1.el9_6, python3-perf 5.14.0-570.123.1.el9_6, kernel-devel-matched 5.14.0-570.123.1.el9_6, kernel-64k-devel-matched 5.14.0-570.123.1.el9_6, +7 more
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.19.1.el9_8, kernel-64k 5.14.0-687.19.1.el9_8, kernel-core 5.14.0-687.19.1.el9_8, kernel-tools 5.14.0-687.19.1.el9_8, kernel-modules 5.14.0-687.19.1.el9_8, kernel-64k-core 5.14.0-687.19.1.el9_8, +27 more
    fixed: vendor fix RHSA-2026:30848
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.28.1.el10_2, kernel-64k 6.12.0-211.28.1.el10_2, kernel-core 6.12.0-211.28.1.el10_2, kernel-tools 6.12.0-211.28.1.el10_2, kernel-modules 6.12.0-211.28.1.el10_2, kernel-64k-core 6.12.0-211.28.1.el10_2, +28 more
    fixed: vendor fix RHSA-2026:30129
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) kernel 6.12.0-55.82.1.el10_0, kernel-64k 6.12.0-55.82.1.el10_0, kernel-core 6.12.0-55.82.1.el10_0, kernel-tools 6.12.0-55.82.1.el10_0, kernel-modules 6.12.0-55.82.1.el10_0, kernel-64k-core 6.12.0-55.82.1.el10_0, +27 more
    fixed: vendor fix RHSA-2026:27731
show 13 more
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) kernel 5.14.0-570.123.1.el9_6, kernel-64k 5.14.0-570.123.1.el9_6, kernel-core 5.14.0-570.123.1.el9_6, kernel-tools 5.14.0-570.123.1.el9_6, kernel-modules 5.14.0-570.123.1.el9_6, kernel-64k-core 5.14.0-570.123.1.el9_6, +27 more
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.19.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.19.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.19.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.19.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.19.1.el9_8
    fixed: vendor fix RHSA-2026:30848
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.28.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.28.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.28.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.28.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.28.1.el10_2
    fixed: vendor fix RHSA-2026:30129
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) libperf 6.12.0-55.82.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.82.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.82.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.82.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.82.1.el10_0
    fixed: vendor fix RHSA-2026:27731
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.19.1.el9_8, kernel-rt-64k 5.14.0-687.19.1.el9_8, kernel-rt-core 5.14.0-687.19.1.el9_8, kernel-rt-modules 5.14.0-687.19.1.el9_8, kernel-rt-64k-core 5.14.0-687.19.1.el9_8, kernel-rt-debug-core 5.14.0-687.19.1.el9_8, +14 more
    fixed: vendor fix RHSA-2026:30848
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.28.1.el10_2, kernel-rt-64k 6.12.0-211.28.1.el10_2, kernel-rt-core 6.12.0-211.28.1.el10_2, kernel-rt-modules 6.12.0-211.28.1.el10_2, kernel-rt-64k-core 6.12.0-211.28.1.el10_2, kernel-rt-debug-core 6.12.0-211.28.1.el10_2, +14 more
    fixed: vendor fix RHSA-2026:30129
  • Red Hat Enterprise Linux Real Time EUS (v. 10.0) kernel-rt 6.12.0-55.82.1.el10_0, kernel-rt-64k 6.12.0-55.82.1.el10_0, kernel-rt-core 6.12.0-55.82.1.el10_0, kernel-rt-modules 6.12.0-55.82.1.el10_0, kernel-rt-64k-core 6.12.0-55.82.1.el10_0, kernel-rt-debug-core 6.12.0-55.82.1.el10_0, +14 more
    fixed: vendor fix RHSA-2026:27731
  • Red Hat Enterprise Linux Real Time EUS (v.9.6) kernel-rt 5.14.0-570.123.1.el9_6, kernel-rt-64k 5.14.0-570.123.1.el9_6, kernel-rt-core 5.14.0-570.123.1.el9_6, kernel-rt-modules 5.14.0-570.123.1.el9_6, kernel-rt-64k-core 5.14.0-570.123.1.el9_6, kernel-rt-debug-core 5.14.0-570.123.1.el9_6, +14 more
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.19.1.el9_8, kernel-rt-core 5.14.0-687.19.1.el9_8, kernel-rt-modules 5.14.0-687.19.1.el9_8, kernel-rt-debug-core 5.14.0-687.19.1.el9_8, kernel-rt-modules-core 5.14.0-687.19.1.el9_8, kernel-rt-debug-modules 5.14.0-687.19.1.el9_8, +4 more
    fixed: vendor fix RHSA-2026:30848
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.28.1.el10_2, kernel-rt-core 6.12.0-211.28.1.el10_2, kernel-rt-modules 6.12.0-211.28.1.el10_2, kernel-rt-debug-core 6.12.0-211.28.1.el10_2, kernel-rt-modules-core 6.12.0-211.28.1.el10_2, kernel-rt-debug-modules 6.12.0-211.28.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:30129
  • Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0) kernel-rt 6.12.0-55.82.1.el10_0, kernel-rt-kvm 6.12.0-55.82.1.el10_0, kernel-rt-core 6.12.0-55.82.1.el10_0, kernel-rt-modules 6.12.0-55.82.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.82.1.el10_0, kernel-rt-debug-core 6.12.0-55.82.1.el10_0, +6 more
    fixed: vendor fix RHSA-2026:27731
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6) kernel-rt 5.14.0-570.123.1.el9_6, kernel-rt-kvm 5.14.0-570.123.1.el9_6, kernel-rt-core 5.14.0-570.123.1.el9_6, kernel-rt-modules 5.14.0-570.123.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.123.1.el9_6, kernel-rt-debug-core 5.14.0-570.123.1.el9_6, +6 more
    fixed: vendor fix RHSA-2026:27708
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
23 d ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8

Classification

Weakness
  • CWE-1341 Multiple Releases of Same Resource or Handle
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.