{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68290", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.380Z", "datePublished": "2026-08-10T12:02:23.425Z", "dateUpdated": "2026-08-17T05:02:25.806Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:02:25.806Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: unregister sysctl before tearing down listen socket\n\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since\nrds_tcp_skbuf_handler() derives the netns from\nrtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with\nnetns teardown and dereference the freed socket/sk.\n\nKASAN reports the race as:\n\n BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0\n rds_tcp_skbuf_handler net/rds/tcp.c:721\n proc_sys_call_handler fs/proc/proc_sysctl.c\n vfs_write fs/read_write.c\n __x64_sys_pwrite64 fs/read_write.c\n\nFix this by unregistering the RDS TCP sysctl table before calling\nrds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl\nhandlers from starting and waits for in-flight handlers to finish, so\nthe listen socket can then be released safely. The fix was tested\nagainst the linked reproducer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered by a local write() /pwrite64() to the per-netns sysctl file /proc/sys/net/rds/tcp/rds_tcp_{snd,rcv}buf racing with network namespace teardown; no network traffic reaches the vulnerable handler, so local syscall access is required.\nAC:L - Although this is a race, the attacker controls both sides: they create the netns, keep the sysctl fd open, choose when the netns is destroyed, and issue the concurrent sysctl write in a tight loop, so the race can be retried indefinitely until won.\nPR:L - Only an unprivileged local account is needed: unshare -Urn yields CAP_NET_ADMIN over the new netns's user_ns, and net_ctl_permissions()/net_ctl_set_ownership() then grant that user write access to the RDS TCP sysctls, while the rds_tcp module is autoloaded by an unprivileged AF_RDS socket.\nUI:N - The attacker performs every step itself \u2014 namespace creation, opening the sysctl file, triggering teardown and writing \u2014 with no action required from any other user or administrator.\nS:U - The use-after-free occurs on kernel slab objects belonging to the same kernel security authority; there is no crossing of a VM, IOMMU or other security boundary.\nC:H - The handler reads the freed listen socket and then dereferences lsock->sk and sock_net(sk); by spraying the freed socket/sk slabs the attacker can steer these dereferences to chosen addresses, turning the use-after-free read into a kernel memory disclosure primitive.\nI:H - Reallocating the freed struct socket/sk with attacker-controlled data lets the attacker supply a bogus struct net pointer that drives rds_tcp_sysctl_reset()/rds_conn_path_drop() over the global RDS connection list, corrupting kernel state and giving the usual UAF path toward control-flow hijack.\nA:H - The confirmed KASAN slab-use-after-free on the freed listen socket readily oopses or panics the kernel, and the race can be repeated by an unprivileged user until it hits, giving a reliable denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/tcp.c"], "versions": [{"version": "de8d6de0ee27be4b2b1e5b06f04aeacbabbba492", "lessThan": "80fffed08dc1c10e971066941d2daa56253f1552", "status": "affected", "versionType": "git"}, {"version": "7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c", "lessThan": "16df2d154ec82e2f7e7585b4fa154751ba37729a", "status": "affected", "versionType": "git"}, {"version": "7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c", "lessThan": "3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d", "status": "affected", "versionType": "git"}, {"version": "7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c", "lessThan": "167e54c703ccd4fa028feb568b0d1002020cff86", "status": "affected", "versionType": "git"}, {"version": "6.12.10", "lessThan": "6.12.101", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/tcp.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.10", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/80fffed08dc1c10e971066941d2daa56253f1552"}, {"url": "https://git.kernel.org/stable/c/16df2d154ec82e2f7e7585b4fa154751ba37729a"}, {"url": "https://git.kernel.org/stable/c/3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d"}, {"url": "https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"}], "title": "rds: tcp: unregister sysctl before tearing down listen socket", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rds/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "80fffed08dc1c10e971066941d2daa56253f1552", "status": "affected", "version": "de8d6de0ee27be4b2b1e5b06f04aeacbabbba492", "versionType": "git"}, {"lessThan": "16df2d154ec82e2f7e7585b4fa154751ba37729a", "status": "affected", "version": "7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c", "versionType": "git"}, {"lessThan": "3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d", "status": "affected", "version": "7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c", "versionType": "git"}, {"lessThan": "167e54c703ccd4fa028feb568b0d1002020cff86", "status": "affected", "version": "7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c", "versionType": "git"}, {"lessThan": "6.12.101", "status": "affected", "version": "6.12.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rds/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: unregister sysctl before tearing down listen socket\n\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since\nrds_tcp_skbuf_handler() derives the netns from\nrtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with\nnetns teardown and dereference the freed socket/sk.\n\nKASAN reports the race as:\n\n BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0\n rds_tcp_skbuf_handler net/rds/tcp.c:721\n proc_sys_call_handler fs/proc/proc_sysctl.c\n vfs_write fs/read_write.c\n __x64_sys_pwrite64 fs/read_write.c\n\nFix this by unregistering the RDS TCP sysctl table before calling\nrds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl\nhandlers from starting and waits for in-flight handlers to finish, so\nthe listen socket can then be released safely. The fix was tested\nagainst the linked reproducer."}], "id": "CVE-2026-68290", "lastModified": "2026-08-17T05:18:31.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:18.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/16df2d154ec82e2f7e7585b4fa154751ba37729a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/80fffed08dc1c10e971066941d2daa56253f1552"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Kernel: Use-after-free vulnerability in RDS TCP can lead to system instability", "id": "2513164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513164"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nrds: tcp: unregister sysctl before tearing down listen socket\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since\nrds_tcp_skbuf_handler() derives the netns from\nrtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with\nnetns teardown and dereference the freed socket/sk.\nKASAN reports the race as:\nBUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0\nrds_tcp_skbuf_handler net/rds/tcp.c:721\nproc_sys_call_handler fs/proc/proc_sysctl.c\nvfs_write fs/read_write.c\n__x64_sys_pwrite64 fs/read_write.c\nFix this by unregistering the RDS TCP sysctl table before calling\nrds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl\nhandlers from starting and waits for in-flight handlers to finish, so\nthe listen socket can then be released safely. The fix was tested\nagainst the linked reproducer.", "A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) TCP implementation. A race condition can occur during network namespace teardown, where a concurrent system control (sysctl) write operation attempts to access a socket that has already been freed. This use-after-free vulnerability can lead to system instability or a denial of service."], "name": "CVE-2026-68290", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:02:23Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68290\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68290\nhttps://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86\nhttps://git.kernel.org/stable/c/16df2d154ec82e2f7e7585b4fa154751ba37729a\nhttps://git.kernel.org/stable/c/3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d\nhttps://git.kernel.org/stable/c/80fffed08dc1c10e971066941d2daa56253f1552"], "threat_severity": "Important"}