CVE-2025-21635

What it actually does

Null pointer dereference in Linux kernel RDS sysctl handlers for rds_tcp_rcvbuf and rds_tcp_sndbuf when current->nsproxy is NULL during task exit, triggered by inconsistent network namespace access via the current task instead of the listen socket.

Why it matters to the business

Kernel oops or crash leading to denial of service on systems using RDS over TCP, with elevated risk in containerized or multi-namespace environments; low exploit probability but requires patching to avoid instability.

How an attack unfolds

An attacker triggers the vulnerable sysctl paths by causing a task to exit while RDS TCP buffer sysctls are accessed, as demonstrated via acct(2) in syzbot reports; the flaw stems from relying on current->nsproxy which becomes NULL, bypassing proper netns retrieval from the table or listen socket.

How to fix it

Update to a fixed kernel containing commit de8d6de0ee27be4b2b1e5b06f04aeacbabbba492; obtain the per-netns structure via container_of() from table->data and retrieve the net structure from the listen socket instead of current->nsproxy.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; test sysctl access under task exit scenarios (e.g., acct(2)) to verify absence of null dereference; review dmesg or kernel logs for related oops entries post-upgrade.

Typical attack path

1. Identify or trigger RDS TCP sysctl access on a system running affected kernel
2. Force a task exit condition (e.g., via process accounting or similar syscall sequences)
3. Cause current->nsproxy to be NULL during the sysctl read/write operation
4. Trigger null pointer dereference resulting in kernel oops or panic

How to detect it

Search kernel logs and dmesg for null pointer dereference oops involving RDS sysctl or nsproxy; review audit logs for acct(2) or sysctl activity coinciding with crashes; no widespread exploitation indicators reported.

What your security team should do

• Prioritize kernel updates on all systems exposing RDS TCP functionality
• Monitor for kernel oops in logs related to RDS sysctl paths
• Restrict unprivileged access to sysctl interfaces where feasible until patched