CVE-2026-99212

In the Linux kernel, the following vulnerability has been resolved:

net/rds: don't let the rdma cm destroy an id RDS still owns on route failure

rds rdma cm event handler cmn() hands the return value of rdma resolve route() straight back to the rdma cm on RDMA CM EVENT ADDR RESOLVED. A synchronous failure there - -ENOMEM from the route work allocation, an SA query that cannot be set up, a RoCE route with no usable device - makes addr handler() destroy the id the event was delivered on. That id is ic->i cm id, and nothing clears the pointer: the connection sits in RDS CONN CONNECTING with a freed id until its shutdown calls rdma disconnect() and rdma destroy id() on it.

The ROUTE RESOLVED case already avoids this: rds ib cm initiate connect() forces a zero return while ic->i cm id == cm id, as the comment there explains. Do the same here - drop the connection and return 0 - so the id stays RDS's to destroy from the shutdown, and the reconnect gets a fresh one.