CVE-2026-98560

In the Linux kernel, the following vulnerability has been resolved:

net/rds: size a connection's path set by the transport it ends up with

rds conn create() computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the loopback transport instead. That substitution is what an RDS/TCP socket sending to a local address gets, and after it the path init loop still runs for the TCP transport's RDS MPATH WORKERS paths and allocates an ordered workqueue for each, while rds loop conn alloc() only ever provides transport data for path 0.

rds conn destroy() sizes its teardown from c trans, by then the loopback transport, so it visits path 0 only - and rds conn path destroy() would skip the other paths anyway, since it returns before destroy workqueue() for a path without transport data. kfree(c path) then drops the last pointers to seven workqueues. That repeats for every such connection, on every netns teardown or module unload, and every distinct local destination address is a separate connection.

Recompute npaths once the transport is final, so that creation and destruction agree on the set of paths. The c path array stays sized for the caller's transport; the unused entries are freed with it.