CVE-2026-68290

Received Received - Intake

Linux Kernel RDS TCP Sysctl Race Condition

Publication date: 2026-08-10

Last updated on: 2026-10-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since rds_tcp_skbuf_handler() derives the netns from rtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with netns teardown and dereference the freed socket/sk. KASAN reports the race as: BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0 rds_tcp_skbuf_handler net/rds/tcp.c:721 proc_sys_call_handler fs/proc/proc_sysctl.c vfs_write fs/read_write.c __x64_sys_pwrite64 fs/read_write.c Fix this by unregistering the RDS TCP sysctl table before calling rds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl handlers from starting and waits for in-flight handlers to finish, so the listen socket can then be released safely. The fix was tested against the linked reproducer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-10-30

Generated

2026-11-08

AI Q&A

2026-08-10

EPSS Evaluated

2026-11-07

NVD

CVE-2026-68290

EUVD

EUVD-2026-55391

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	rds_tcp	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RDS TCP module. It occurs when the RDS TCP listen socket is freed before unregistering the per-netns sysctl table. A race condition can happen where a concurrent sysctl write operation tries to access the freed socket, leading to a kernel crash reported by KASAN.

Detection Guidance

This vulnerability involves a race condition in the Linux kernel's RDS TCP module. Detection requires checking kernel logs for KASAN reports or slab-use-after-free errors related to rds_tcp_skbuf_handler. Monitor sysctl writes during network namespace teardown. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause system instability or crashes due to kernel memory corruption. It may lead to denial-of-service conditions where the affected system becomes unresponsive or requires a reboot. Systems using RDS over TCP could experience unexpected failures.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a race condition in the Linux kernel's RDS TCP module that could lead to a use-after-free error, potentially causing system instability or crashes. No evidence suggests it impacts data protection or privacy controls required by GDPR or HIPAA.

Mitigation Strategies

Apply the kernel patch that unregisters the RDS TCP sysctl table before tearing down the listen socket. Update to a fixed Linux kernel version. Monitor for KASAN reports or crashes during network namespace operations.

Hi! I’m here to help you understand CVE-2026-68290. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...