Cloudanix VulnDB

CVE-2026-68335

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel handles certain network messages across isolated network areas can let a local attacker crash the system or take full control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Medium

What it actually does

Use-after-free in RDS receive path: rds_find_bound() ignores network namespaces, allowing a message from one netns to bind to a socket in another; subsequent netns cleanup frees the rds_connection while the inc still references it, enabling reads of freed memory (c_lcong) and arbitrary function pointer invocation (c_trans->inc_free).

Why it matters to the business

Local attackers on Linux systems using RDS can crash the kernel or escalate privileges, risking data integrity, service availability, and potential container escape in multi-tenant or namespace-isolated environments.

How an attack unfolds

An attacker creates user and network namespaces, establishes an RDS socket in one namespace, and sends a message that crosses into a socket in a second namespace. When the first namespace is torn down, cleanup frees the connection object; any later dereference from the surviving inc triggers the use-after-free, either reading freed data or calling a function pointer through the freed object.

How to fix it

Apply the upstream fix that adds a net_eq(rds_conn_net(c), sock_net(rs->rs_sock)) check inside rds_recv_incoming() before delivery; rebuild and deploy the patched kernel on all affected hosts.

How to confirm the fix worked

Inspect rds_recv_incoming() for the namespace-equality guard using rds_conn_net() and sock_net(); run namespace-crossing RDS message tests under KASAN to confirm absence of use-after-free reports.

Typical attack path

  1. Create unprivileged user+network namespace (CLONE_NEWUSER|CLONE_NEWNET)
  2. Bind RDS socket in the target namespace
  3. Send crafted RDS message from the source namespace that matches the (addr,port) lookup
  4. Trigger namespace exit to invoke rds_conn_destroy on the connection
  5. Force rds_clear_recv_queue or rds_inc_put on the surviving inc to dereference freed memory

How to detect it

Search kernel logs and KASAN reports for use-after-free mentions involving rds_inc, rds_connection, rds_clear_recv_queue, or rds_recv_rcvbuf_delta; inspect crash dumps for dereferences at offset 88 or function pointers at offset 80 of a freed rds_connection.

What your security team should do

  • Prioritize kernel updates on all systems exposing RDS or allowing unprivileged user namespaces
  • Disable RDS module (modprobe -r rds) where not required
  • Restrict unprivileged namespace creation via kernel.unprivileged_userns_clone sysctl
  • Monitor for KASAN or Oops reports involving rds_inc or rds_connection structures

The record

In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rds_find_bound() looks up the destination socket using a global rhashtable keyed solely on (addr, port, scope_id). Network namespaces are not part of the key, so a sender in netns A can deliver an incoming message (inc) to a socket that lives in a different netns B. When this happens, inc->i_conn points to an rds_connection whose c_net is netns A, but the receiving rs lives in netns B. Once the child process that created netns A exits, cleanup_net() calls rds_loop_exit_net() -> rds_loop_kill_conns() -> rds_conn_destroy(), freeing that connection. If the survivor socket in netns B still holds the inc, any subsequent dereference of inc->i_conn is a use-after-free. There are two dangerous sites in rds_clear_recv_queue(): 1. inc->i_conn->c_lcong (offset 88 of freed rds_connection, size 200) read via rds_recv_rcvbuf_delta() -- confirmed by KASAN. 2. inc->i_conn->c_trans->inc_free(inc) (function pointer at offset 80) called via rds_inc_put() when the inc refcount reaches zero -- same race window, potential call-through-freed-object primitive. The bug is reachable from unprivileged user namespaces (CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8. Fix this by rejecting the delivery in rds_recv_incoming() when the socket returned by rds_find_bound() belongs to a different network namespace than the connection that carried the message. Use the existing rds_conn_net() / sock_net() helpers and net_eq() for the comparison.

Affected packages

Ecosystem Package Introduced Fixed