CVE-2026-68335
Received Received - Intake

Use-After-Free in Linux Kernel RDS Network Namespace Handling

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rds_find_bound() looks up the destination socket using a global rhashtable keyed solely on (addr, port, scope_id). Network namespaces are not part of the key, so a sender in netns A can deliver an incoming message (inc) to a socket that lives in a different netns B. When this happens, inc->i_conn points to an rds_connection whose c_net is netns A, but the receiving rs lives in netns B. Once the child process that created netns A exits, cleanup_net() calls rds_loop_exit_net() -> rds_loop_kill_conns() -> rds_conn_destroy(), freeing that connection. If the survivor socket in netns B still holds the inc, any subsequent dereference of inc->i_conn is a use-after-free. There are two dangerous sites in rds_clear_recv_queue(): 1. inc->i_conn->c_lcong (offset 88 of freed rds_connection, size 200) read via rds_recv_rcvbuf_delta() -- confirmed by KASAN. 2. inc->i_conn->c_trans->inc_free(inc) (function pointer at offset 80) called via rds_inc_put() when the inc refcount reaches zero -- same race window, potential call-through-freed-object primitive. The bug is reachable from unprivileged user namespaces (CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8. Fix this by rejecting the delivery in rds_recv_incoming() when the socket returned by rds_find_bound() belongs to a different network namespace than the connection that carried the message. Use the existing rds_conn_net() / sock_net() helpers and net_eq() for the comparison.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68335
EUVD
EUVD-2026-55436

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel From 3.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) module. It occurs when messages cross network namespace boundaries, causing a socket in one network namespace to receive a message intended for another. This leads to a situation where a connection structure is freed while still being referenced, resulting in potential memory corruption or arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDS module and requires kernel-level access to detect. Check if your kernel version includes the vulnerable code path by examining loaded modules and kernel logs for RDS-related errors or crashes.

Impact Analysis

An attacker with access to user namespaces (CLONE_NEWUSER + CLONE_NEWNET) could exploit this to crash the system or execute arbitrary code with kernel privileges. This could lead to denial of service, data breaches, or full system compromise if unprivileged users have access to create such namespaces.

Mitigation Strategies

Apply the latest kernel security patches to address the issue. Disable the RDS module if not in use. Restrict access to user namespaces by modifying kernel parameters or using security modules like SELinux.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart