CVE-2026-97954 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using large page sizes, should assess exposure and verify system configurations. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that their systems are updated and configured correctly to prevent TCP stream corruption.

Why it matters

A vulnerability in the Linux kernel's RDS-TCP implementation could lead to TCP stream corruption when using large page sizes, requiring verification of system configurations and page size settings.

• Stream corruption could lead to unexpected behavior or crashes on affected systems
• Verification of Linux kernel version and page size settings is necessary to assess exposure
• Remediation involves applying the patch to limit scatterlist mapping to remaining bytes

Technical summary

The Linux kernel's RDS-TCP implementation is vulnerable to TCP stream corruption when using large page sizes. The issue arises from rds_message_map_pages() assigning PAGE_SIZE bytes to every scatterlist entry, even when the total length ends in a partial page. This could cause the scatterlist to map bytes beyond the end of the congestion map, resulting in extra bytes being transmitted as part of the TCP RDS stream and interpreted as subsequent RDS message headers. The issue was resolved by limiting the final scatterlist mapping to the number of bytes remaining. This change allows RDS-TCP to be used on systems with 16K and larger page sizes without corrupting the stream.

Defensive priority

Defenders should prioritize verifying the Linux kernel version and assessing exposure on systems with large page sizes.

Recommended defensive actions

• Verify Linux kernel version and assess exposure on systems with large page sizes
• Review system configurations and page size settings
• Monitor for potential stream corruption issues
• Apply the patch to limit scatterlist mapping to remaining bytes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue was resolved by limiting the final scatterlist mapping to the number of bytes remaining. This change allows RDS-TCP to be used on systems with 16K and larger page sizes without corrupting the stream.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.