GHSA-C7H5-Q22G-86GX
Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-19 18:32In the Linux kernel, the following vulnerability has been resolved:
rds: drop incoming messages that cross network namespace boundaries
rds_find_bound() looks up the destination socket using a global rhashtable keyed solely on (addr, port, scope_id). Network namespaces are not part of the key, so a sender in netns A can deliver an incoming message (inc) to a socket that lives in a different netns B.
When this happens, inc->i_conn points to an rds_connection whose c_net is netns A, but the receiving rs lives in netns B. Once the child process that created netns A exits, cleanup_net() calls rds_loop_exit_net() -> rds_loop_kill_conns() -> rds_conn_destroy(), freeing that connection. If the survivor socket in netns B still holds the inc, any subsequent dereference of inc->i_conn is a use-after-free.
There are two dangerous sites in rds_clear_recv_queue(): 1. inc->i_conn->c_lcong (offset 88 of freed rds_connection, size 200) read via rds_recv_rcvbuf_delta() -- confirmed by KASAN. 2. inc->i_conn->c_trans->inc_free(inc) (function pointer at offset 80) called via rds_inc_put() when the inc refcount reaches zero -- same race window, potential call-through-freed-object primitive.
The bug is reachable from unprivileged user namespaces (CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8.
Fix this by rejecting the delivery in rds_recv_incoming() when the socket returned by rds_find_bound() belongs to a different network namespace than the connection that carried the message. Use the existing rds_conn_net() / sock_net() helpers and net_eq() for the comparison.
{
"affected": [],
"aliases": [
"CVE-2026-68335"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T13:20:23Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: drop incoming messages that cross network namespace boundaries\n\nrds_find_bound() looks up the destination socket using a global\nrhashtable keyed solely on (addr, port, scope_id). Network namespaces\nare not part of the key, so a sender in netns A can deliver an incoming\nmessage (inc) to a socket that lives in a different netns B.\n\nWhen this happens, inc-\u003ei_conn points to an rds_connection whose c_net\nis netns A, but the receiving rs lives in netns B. Once the child\nprocess that created netns A exits, cleanup_net() calls\nrds_loop_exit_net() -\u003e rds_loop_kill_conns() -\u003e rds_conn_destroy(),\nfreeing that connection. If the survivor socket in netns B still holds\nthe inc, any subsequent dereference of inc-\u003ei_conn is a use-after-free.\n\nThere are two dangerous sites in rds_clear_recv_queue():\n 1. inc-\u003ei_conn-\u003ec_lcong (offset 88 of freed rds_connection, size 200)\n read via rds_recv_rcvbuf_delta() -- confirmed by KASAN.\n 2. inc-\u003ei_conn-\u003ec_trans-\u003einc_free(inc) (function pointer at offset 80)\n called via rds_inc_put() when the inc refcount reaches zero -- same\n race window, potential call-through-freed-object primitive.\n\nThe bug is reachable from unprivileged user namespaces\n(CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8.\n\nFix this by rejecting the delivery in rds_recv_incoming() when the\nsocket returned by rds_find_bound() belongs to a different network\nnamespace than the connection that carried the message. Use the\nexisting rds_conn_net() / sock_net() helpers and net_eq() for the\ncomparison.",
"id": "GHSA-c7h5-q22g-86gx",
"modified": "2026-08-19T18:32:15Z",
"published": "2026-08-10T15:33:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68335"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/03c574112e5d066df0ddce36d7438e850bcf3050"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0f8690e3869109cd5803ccb400889d20a0b54e0e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1e2e2d9806944fe485824d617c8b7c78116c22db"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5521ae71e32a8069ed4ca6e792179dc57bc43ab2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/742ff6f02545212e991cd8b45011e40d2c2ef25a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9591042533140dfe6608d9344806d567dcd39d02"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/abff41fd928328bbf3dda1140beb2e61fa424ccd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cfb3ce07b705e486e022a2f2b1242b48f13981ff"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.