CVE-2026-68290

CVE CVE-2026-68290EUVD EUVD-2026-55391Published 2026-08-10T12:02:23.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since rds_tcp_skbuf_handler() derives the netns from rtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with netns teardown and dereference the freed socket/sk. KASAN reports the race as: BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0 rds_tcp_skbuf_handler net/rds/tcp.c:721 proc_sys_call_handler fs/proc/proc_sysctl.c vfs_write fs/read_write.c __x64_sys_pwrite64 fs/read_write.c Fix this by unregistering the RDS TCP sysctl table before calling rds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl handlers from starting and waits for in-flight handlers to finish, so the listen socket can then be released safely. The fix was tested against the linked reproducer.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c <16df2d154ec82e2f7e7585b4fa154751ba37729a; patch: 7.1.6; 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c <167e54c703ccd4fa028feb568b0d1002020cff86; 6.13; patch: 6.18.42; 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c <3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d; patch: 0; 6.12.10 <6.12.101; de8d6de0ee27be4b2b1e5b06f04aeacbabbba492 <80fffed08dc1c10e971066941d2daa56253f1552; patch: 7.2-rc5; patch: 6.12.101

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.