CVE-2026-68290
Received Received - Intake

Linux Kernel RDS TCP Sysctl Race Condition

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since rds_tcp_skbuf_handler() derives the netns from rtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with netns teardown and dereference the freed socket/sk. KASAN reports the race as: BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0 rds_tcp_skbuf_handler net/rds/tcp.c:721 proc_sys_call_handler fs/proc/proc_sysctl.c vfs_write fs/read_write.c __x64_sys_pwrite64 fs/read_write.c Fix this by unregistering the RDS TCP sysctl table before calling rds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl handlers from starting and waits for in-flight handlers to finish, so the listen socket can then be released safely. The fix was tested against the linked reproducer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68290
EUVD
EUVD-2026-55391

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel rds_tcp *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RDS TCP module. It occurs when the RDS TCP listen socket is freed before unregistering the per-netns sysctl table. A race condition can happen where a concurrent sysctl write operation tries to access the freed socket, leading to a kernel crash reported by KASAN.

Detection Guidance

This vulnerability involves a race condition in the Linux kernel's RDS TCP module. Detection requires checking kernel logs for KASAN reports or slab-use-after-free errors related to rds_tcp_skbuf_handler. Monitor sysctl writes during network namespace teardown. No specific commands are provided in the context.

Impact Analysis

This vulnerability can cause system instability or crashes due to kernel memory corruption. It may lead to denial-of-service conditions where the affected system becomes unresponsive or requires a reboot. Systems using RDS over TCP could experience unexpected failures.

Mitigation Strategies

Apply the kernel patch that unregisters the RDS TCP sysctl table before tearing down the listen socket. Update to a fixed Linux kernel version. Monitor for KASAN reports or crashes during network namespace operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart