CVE-2026-52995: Linux Kernel Information Disclosure

CVE-2026-52995 Overview

CVE-2026-52995 is a Linux kernel information disclosure vulnerability in the Reliable Datagram Sockets (RDS) subsystem. The flaw resides in rds_for_each_conn_info() and rds_walk_conn_path_info(), which pass a caller-allocated on-stack u64 buffer to per-connection visitors and copy the full item_len bytes back to user space regardless of how much data the visitor actually wrote. When the underlying rds_connection is not in state RDS_CONN_UP, the IB visitors populate only a subset of the output struct, leaving stack residue, including kernel pointers, exposed through rds_info_copy().

Critical Impact
A local unprivileged user can leak kernel stack memory, including kernel text and data pointers usable to defeat KASLR and build follow-on exploits.

Affected Products

Linux kernel net/rds subsystem (Reliable Datagram Sockets)
Builds without CONFIG_INIT_STACK_ALL_ZERO=y
Systems exposing AF_RDS sockets with an RDMA-capable netdev (including rxe soft-RoCE)

Discovery Timeline

2026-06-24 - CVE-2026-52995 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52995

Vulnerability Analysis

The vulnerability is an uninitialized memory disclosure [CWE-908] in the RDS info-reporting path. Both rds_ib_conn_info_visitor() and rds6_ib_conn_info_visitor() zero only the source address, destination address, tos, sl, and the two GIDs when the connection is not fully established. They leave several u32 fields untouched: max_send_wr, max_recv_wr, max_send_sge, rdma_mr_max, rdma_mr_size, and cache_allocs.

The output types struct rds_info_rdma_connection and struct rds6_info_rdma_connection are the only RDS info structs in include/uapi/linux/rds.h not marked __attribute__((packed)). They contain a real 2-byte alignment hole between sl and cache_allocs that is also never initialized.

rds_info_copy() then performs a memcpy_to_user() of the full item length. The user receives stack contents that preceded the visitor call, which on a 68-byte item includes 26 bytes of kernel data such as code and data pointers.

Root Cause

The root cause is that the per-item buffer used by the info iterators is not zeroed before being handed to the visitor callback. Visitors are not required to write every field, but the iterator unconditionally copies the entire buffer back to user space.

Attack Vector

A local unprivileged user opens an AF_RDS socket, sets SO_RDS_TRANSPORT=IB, binds to a local address on an RDMA-capable netdev (rxe soft-RoCE on any netdev is sufficient), and calls sendto() to install an rds_connection in the global hash in the RDS_CONN_CONNECTING state. The attacker then calls getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) and reads the 68-byte item, which contains kernel pointers and other uninitialized stack contents.

The upstream fix zeroes the per-item buffer in both rds_for_each_conn_info() and rds_walk_conn_path_info() before invoking the visitor. This hardens both current IB visitors and any future visitor that adds a conditional write path. See the Kernel Stable Commit for the patch.

Detection Methods for CVE-2026-52995

Indicators of Compromise

Unprivileged processes opening AF_RDS sockets on hosts without an operational RDS workload.
Userspace callers invoking getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) or the IPv6 equivalent.
Loading of the rds and rds_rdma kernel modules on systems that do not use RDMA messaging.

Detection Strategies

Audit kernel module load events for rds, rds_rdma, and rdma_rxe outside of expected hosts.
Monitor socket() syscalls with the AF_RDS family using eBPF or auditd rules.
Correlate suspicious local enumeration with subsequent privilege escalation attempts that rely on leaked kernel addresses.

Monitoring Recommendations

Track running kernel versions against the patched commits listed in the upstream stable tree.
Alert on processes that perform getsockopt calls against RDS info options from non-administrative users.
Baseline expected RDS usage in workloads and flag deviations.

How to Mitigate CVE-2026-52995

Immediate Actions Required

Apply the upstream kernel patches from the stable tree that zero the per-item buffer in rds_for_each_conn_info() and rds_walk_conn_path_info().
Inventory all Linux hosts and identify kernels built without CONFIG_INIT_STACK_ALL_ZERO=y, which are the exposed configurations.
Restrict loading of the rds, rds_rdma, and rdma_rxe modules on systems that do not require RDS.

Patch Information

The fix is distributed across multiple stable branches. Reference the upstream commits: commit 0797b2e, commit 5e67cc2, commit 81651e9, commit 912ba2e, commit 91ce1bb, commit b6ba93a, commit c7cb9ee, and commit c88eb7e.

Workarounds

Rebuild the kernel with CONFIG_INIT_STACK_ALL_ZERO=y to neutralize the disclosure until the patch can be deployed.
Blacklist the rds and rds_rdma modules via /etc/modprobe.d/ on hosts that do not use Reliable Datagram Sockets.
Restrict unprivileged user access to the AF_RDS socket family using seccomp profiles or LSM policies such as SELinux or AppArmor.

bash

# Configuration example
echo 'install rds /bin/true' | sudo tee /etc/modprobe.d/blacklist-rds.conf
echo 'install rds_rdma /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-rds.conf
echo 'install rdma_rxe /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-rds.conf
sudo update-initramfs -u