CVE-2026-43226: Linux Kernel RDS Connection DOS Flaw

CVE-2026-43226 Overview

CVE-2026-43226 is a Linux kernel vulnerability in the Reliable Datagram Sockets (RDS) networking subsystem. The flaw resides in the RDS/TCP multipath code path that manages connection state transitions through rds_conn_path::cp_state. A shortcut in rds_tcp_accept_one_path allows a connection to move directly from RDS_CONN_ERROR back to RDS_CONN_CONNECTING, bypassing the expected shutdown path. A subsequent call to rds_tcp_reset_callbacks can then push the connection into RDS_CONN_RESETTING, an unhandled state in rds_conn_init_shutdown, leaving RDS_SHUTDOWN_WORK_QUEUED set indefinitely.

Critical Impact
The unexpected state transition causes connection shutdown work to remain queued forever, leading to RDS connection hang conditions and potential denial-of-service on affected Linux hosts using RDS over TCP.

Affected Products

Linux kernel versions containing the RDS/TCP multipath implementation
Systems with the net/rds subsystem enabled and using TCP transport
Distributions shipping vulnerable kernel versions prior to the upstream stable fixes

Discovery Timeline

2026-05-06 - CVE-2026-43226 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43226

Vulnerability Analysis

RDS connections track lifecycle progression through rds_conn_path::cp_state and rely on rds_conn_path_transition to enforce conditional state changes. The function only permits a transition when the current state matches an expected source state. One exception exists: rds_conn_path_drop can force a connection into RDS_CONN_ERROR regardless of current state.

Once a connection enters RDS_CONN_ERROR, the code path expects the connection to traverse the shutdown sequence. The RDS/TCP multipath changes introduced a shortcut in rds_tcp_accept_one_path, called from contexts such as rds_tcp_state_change, that transitions the connection straight from RDS_CONN_ERROR back to RDS_CONN_CONNECTING. This skips the required shutdown handling.

Root Cause

The root cause is an incomplete state machine. After the shortcut returns the connection to RDS_CONN_CONNECTING, a follow-up call to rds_tcp_reset_callbacks can transition the state to RDS_CONN_RESETTING and queue a shutdown worker. The function rds_conn_init_shutdown was never updated to accept RDS_CONN_RESETTING as a valid source state. It instead drops the connection with DR_INV_CONN_STATE, leaving RDS_SHUTDOWN_WORK_QUEUED permanently set. This is a kernel state-machine logic flaw rather than a memory-safety bug.

Attack Vector

Triggering the condition requires inducing an RDS/TCP connection error followed by a re-accept event on the same path. The fault occurs through normal RDS/TCP socket operations and does not require crafted memory corruption. The vulnerability manifests on hosts that expose RDS over TCP to peers capable of generating connection-state churn. Refer to the upstream Linux kernel commits for the precise code paths involved.

The upstream fix applies two changes: it removes the shortcut so connections in RDS_CONN_ERROR always traverse the shutdown path, and it adds RDS_CONN_RESETTING to the expected states accepted by rds_conn_init_shutdown.

Detection Methods for CVE-2026-43226

Indicators of Compromise

Kernel log entries referencing DR_INV_CONN_STATE from the RDS subsystem
RDS connections stuck with RDS_SHUTDOWN_WORK_QUEUED set and no progress through shutdown
Persistent rds_conn_path instances oscillating between RDS_CONN_ERROR and RDS_CONN_CONNECTING

Detection Strategies

Monitor dmesg and /var/log/kern.log for repeated RDS state-transition errors and invalid connection state messages
Inspect /proc/net/rds/connections for connections stalled in non-terminal states
Audit running kernel versions across the fleet against the fixed stable kernel commits referenced in the Linux Kernel Stable Tree

Monitoring Recommendations

Alert on sustained growth of queued RDS shutdown work items via kernel tracepoints
Track kernel version inventory and flag hosts running unpatched kernels with CONFIG_RDS_TCP=y
Correlate RDS error log volume with network connectivity events to identify exploitable conditions

How to Mitigate CVE-2026-43226

Immediate Actions Required

Apply the upstream stable kernel updates that include the RDS state-transition fix referenced in the kernel.org commits
Identify hosts with the RDS module loaded using lsmod | grep rds and prioritize patching where RDS/TCP is in active use
Restrict RDS/TCP exposure to trusted network segments until patched kernels are deployed

Patch Information

The fix is committed in the Linux stable trees. See the relevant patches: commit 19e384a7d00d, commit 81248b1eb3c5, commit 899ef00963ce, commit 9bcd7c00691a, commit 9ff599a9be78, commit a179ac7be8f5, commit ad22d24be635, and commit f0f729bdffb0. Update to a stable kernel release that incorporates these commits.

Workarounds

Disable the RDS module where it is not required by blacklisting rds and rds_tcp in /etc/modprobe.d/
Block RDS/TCP traffic at host or network firewalls if the protocol is not in production use
Reboot affected hosts to clear stuck RDS_SHUTDOWN_WORK_QUEUED state when symptoms are observed

bash

# Configuration example
# Blacklist RDS modules to mitigate exposure on hosts that do not require RDS
echo "blacklist rds" | sudo tee /etc/modprobe.d/blacklist-rds.conf
echo "blacklist rds_tcp" | sudo tee -a /etc/modprobe.d/blacklist-rds.conf
sudo update-initramfs -u

# Verify modules are not currently loaded
lsmod | grep -E '^rds'