CVE-2026-68290: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68290 Overview

CVE-2026-68290 is a use-after-free vulnerability in the Linux kernel's Reliable Datagram Sockets (RDS) TCP transport. The flaw exists in rds_tcp_exit_net(), which frees the per-network-namespace RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the per-netns sysctl table. A concurrent sysctl write can race with network namespace teardown and dereference the freed socket. KASAN confirms the race as a slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0. A local attacker with the ability to write to the RDS TCP sysctl interface during namespace teardown can trigger memory corruption.

Critical Impact
Local attackers can exploit a race condition in the Linux kernel RDS TCP subsystem to trigger a use-after-free, leading to kernel memory corruption, denial of service, or potential local privilege escalation.

Affected Products

Linux kernel versions containing the vulnerable rds_tcp_exit_net() ordering logic
Distributions shipping the affected RDS TCP transport module (net/rds/tcp.c)
Systems with the RDS kernel module loaded and accessible sysctl interface

Discovery Timeline

2026-08-10 - CVE-2026-68290 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68290

Vulnerability Analysis

The vulnerability resides in the RDS (Reliable Datagram Sockets) TCP transport code at net/rds/tcp.c. During per-network-namespace teardown, rds_tcp_exit_net() invokes rds_tcp_kill_sock() to release the RDS TCP listen socket before unregistering the associated sysctl table. This ordering creates a window where sysctl handlers remain reachable from userspace while the socket they depend on has already been freed.

The rds_tcp_skbuf_handler() function derives its network namespace pointer from rtn->rds_tcp_listen_sock->sk. When a userspace process writes to the RDS TCP sysctl entries concurrently with namespace teardown, the handler dereferences a dangling socket pointer. KASAN identifies this as a slab-use-after-free reachable through the proc_sys_call_handler → vfs_write → __x64_sys_pwrite64 path.

Root Cause

The root cause is incorrect teardown ordering in rds_tcp_exit_net(). The listen socket is destroyed before the sysctl table that references it is unregistered. Because unregister_net_sysctl_table() is the synchronization point that blocks new handler invocations and drains in-flight ones, freeing the socket first leaves an exploitable race window.

Attack Vector

Exploitation requires local access with the ability to issue write operations against the RDS TCP sysctl entries in /proc/sys/net/rds/tcp/. An attacker triggers repeated network namespace teardown while concurrently writing to the sysctl interface. When the timing aligns, the sysctl handler dereferences the freed listen socket, corrupting kernel memory. Successful exploitation can yield denial of service or local privilege escalation depending on heap layout and reallocation control.

No verified public proof-of-concept exploit is currently listed. Technical details for the race are described in the upstream kernel commit.

Detection Methods for CVE-2026-68290

Indicators of Compromise

KASAN reports containing slab-use-after-free in rds_tcp_skbuf_handler in kernel logs
Unexpected kernel oops or panic traces referencing rds_tcp_skbuf_handler, proc_sys_call_handler, or rds_tcp_kill_sock
Unusual patterns of writes to /proc/sys/net/rds/tcp/* coinciding with network namespace creation and destruction

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free events in the RDS TCP path
Audit loaded kernel modules and flag systems where rds_tcp is present but not operationally required
Correlate unshare, clone(CLONE_NEWNET), and container lifecycle events with concurrent writes to RDS sysctl entries

Monitoring Recommendations

Collect dmesg and /var/log/kern.log entries containing rds_tcp, KASAN, or use-after-free signatures
Monitor process activity generating high-frequency pwrite64 syscalls targeting /proc/sys/net/rds/
Track unprivileged user namespace creation combined with RDS module usage across the fleet

How to Mitigate CVE-2026-68290

Immediate Actions Required

Apply the upstream Linux kernel patches that reorder teardown so unregister_net_sysctl_table() runs before rds_tcp_kill_sock()
Unload the rds_tcp and rds kernel modules on systems that do not require RDS functionality
Restrict access to the RDS sysctl interface through Linux capabilities and mandatory access control policies

Patch Information

The fix unregisters the RDS TCP sysctl table before tearing down the listen socket. unregister_net_sysctl_table() prevents new sysctl handlers from starting and waits for in-flight handlers to finish, allowing the listen socket to be released safely. Patch commits are available at kernel.org commit 167e54c7, commit 16df2d15, commit 3aa13fe0, and commit 80fffed0.

Workarounds

Blacklist the rds and rds_tcp modules via /etc/modprobe.d/ on hosts that do not use RDS
Disable unprivileged user namespaces where operationally feasible to reduce local attack surface
Apply seccomp or AppArmor profiles that restrict pwrite64 access to /proc/sys/net/rds/tcp/ for untrusted workloads

bash

# Configuration example: blacklist RDS modules to eliminate the attack surface
echo "blacklist rds" | sudo tee /etc/modprobe.d/blacklist-rds.conf
echo "blacklist rds_tcp" | sudo tee -a /etc/modprobe.d/blacklist-rds.conf

# Prevent on-demand loading
echo "install rds /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-rds.conf
echo "install rds_tcp /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-rds.conf

# Unload if currently loaded
sudo modprobe -r rds_tcp rds 2>/dev/null || true

# Verify
lsmod | grep -E '^rds'