CVE-2026-68290

What it actually does

Use-after-free in RDS TCP sysctl handler during network namespace teardown: rds_tcp_exit_net frees the per-netns listen socket before unregistering the sysctl table, allowing a concurrent procfs write to dereference the freed sk pointer inside rds_tcp_skbuf_handler.

Why it matters to the business

Local attackers on affected Linux systems can trigger a kernel crash or potentially escalate privileges, leading to denial of service or full host compromise; the issue affects any deployment using RDS over TCP with sysctl access during namespace destruction.

How an attack unfolds

An attacker with local access crafts a concurrent sysctl write against the RDS TCP table while triggering netns teardown (e.g., via container shutdown or network namespace deletion); the race lets the handler run after the socket is freed, producing a KASAN-detected slab use-after-free that can be turned into arbitrary read/write or control-flow hijacking.

How to fix it

Upgrade the Linux kernel to a version containing the fix that unregisters the RDS TCP sysctl table before calling rds_tcp_kill_sock; apply the stable backport or mainline commit that reorders exit_net cleanup; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the kernel source contains the reordered unregister_net_sysctl_table call before rds_tcp_kill_sock in rds_tcp_exit_net; run the linked reproducer under KASAN to verify absence of slab-use-after-free; check /proc/sys/net/rds still functions correctly after namespace teardown.

Typical attack path

1. Obtain local code execution or shell on the target host
2. Open or trigger RDS TCP sysctl entries under /proc/sys/net/rds/tcp
3. Concurrently destroy the network namespace containing the RDS TCP socket
4. Win the race so rds_tcp_skbuf_handler executes after socket free
5. Leverage the resulting use-after-free for kernel memory corruption or DoS

How to detect it

Search kernel logs for KASAN reports referencing rds_tcp_skbuf_handler and slab-use-after-free; inspect audit logs for rapid sysctl writes followed by netns deletion events; review container runtime logs for namespace teardown coinciding with RDS TCP activity.

• BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler
• rds_tcp_skbuf_handler+0x2aa/0x2e0
• proc_sys_call_handler.*rds_tcp

What your security team should do

• Prioritize kernel updates on all multi-tenant or containerized hosts using RDS TCP
• Monitor EPSS trend and re-evaluate if exploit code appears
• Restrict unprivileged access to procfs sysctl writes where feasible
• Test namespace teardown paths in staging before production rollout