CVE-2026-68322: Linux Kernel RDS DOS Vulnerability

CVE-2026-68322 Overview

CVE-2026-68322 is a NULL pointer dereference vulnerability in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. The flaw occurs when a system boots with the ipv6.disable=1 kernel parameter. Under this configuration, inet6_init() exits before addrconf_init() initializes inet6_addr_lst. An unprivileged local process that binds an RDS socket to an IPv6 address triggers a crash inside __ipv6_chk_addr_and_flags(). The issue was found by InfoTeCS on behalf of the Linux Verification Center (linuxtesting.org) using Syzkaller.

Critical Impact
A local, unprivileged user can crash the kernel and cause a denial of service by binding an RDS socket to an IPv6 address on systems booted with IPv6 disabled.

Affected Products

Linux kernel builds with CONFIG_RDS and CONFIG_IPV6 enabled
Systems booted with the ipv6.disable=1 kernel parameter
Stable kernel branches referenced by the upstream fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68322 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68322

Vulnerability Analysis

The vulnerability lives in the RDS transport path that validates IPv6 source addresses. When user space calls bind(2) on a PF_RDS socket with an AF_INET6 address, the kernel invokes rds_bind(), which calls rds_trans_get_preferred() and then rds_tcp_laddr_check(). That helper calls ipv6_chk_addr(), which walks the global inet6_addr_lst hash table inside __ipv6_chk_addr_and_flags().

On systems booted with ipv6.disable=1, inet6_init() returns early and never calls addrconf_init(), leaving inet6_addr_lst uninitialized. The subsequent dereference produces a KASAN-detected NULL pointer access in the range [0x0000000000000008-0x000000000000000f], panicking the calling task.

Root Cause

The RDS transport code assumes IPv6 address book-keeping structures are always available whenever the kernel is built with IPv6 support. It does not consult the runtime state exposed by ipv6_mod_enabled() before invoking IPv6 address lookups. When IPv6 is disabled at boot, the inet6_addr_lst hash table pointer used by __ipv6_chk_addr_and_flags() is NULL, and the RDS bind path reaches it without a guard.

Attack Vector

Exploitation requires local access and the ability to create an AF_RDS socket. A caller creates a socket with socket(PF_RDS, SOCK_SEQPACKET, 0), fills a sockaddr_in6 with an IPv6 address and family, and calls bind(2). On a target booted with ipv6.disable=1, the bind operation triggers the NULL dereference inside __ipv6_chk_addr_and_flags() and produces the following call chain reported by KASAN: ipv6_chk_addr → rds_tcp_laddr_check → rds_trans_get_preferred → rds_bind → __sys_bind → __x64_sys_bind. The result is a kernel crash and denial of service. No remote vector is described in the advisory.

See the Linux Kernel Commit 9c805e5 for the upstream fix that adds the missing guard before the IPv6 address lookup.

Detection Methods for CVE-2026-68322

Indicators of Compromise

Kernel oops or KASAN report referencing __ipv6_chk_addr_and_flags+0x1df/0x7e0 with a null-ptr-deref in range [0x0000000000000008-0x000000000000000f].
Crash call traces containing rds_tcp_laddr_check, rds_trans_get_preferred, and rds_bind frames.
Unexpected bind() failures or task terminations on hosts booted with ipv6.disable=1.

Detection Strategies

Inventory Linux hosts that boot with ipv6.disable=1 and have the rds or rds_tcp modules loadable or loaded. Check with lsmod | grep rds and cat /proc/cmdline.
Alert on kernel log entries containing RIP: 0010:__ipv6_chk_addr_and_flags or KASAN: null-ptr-deref correlated with RDS symbols.
Monitor process telemetry for unusual creation of PF_RDS sockets by non-administrative users, especially followed by bind() calls with AF_INET6.

Monitoring Recommendations

Forward dmesg, /var/log/kern.log, and journalctl -k output to a central log store and search for the crash signature.
Track kernel version and boot parameters across the fleet to identify unpatched hosts still exposed to the RDS path.
Watch for repeated kernel task crashes from the same UID, which suggests an attempt to trigger the flaw.

How to Mitigate CVE-2026-68322

Immediate Actions Required

Apply the upstream stable kernel updates that contain the fix commits listed below.
Where patching must be deferred, blacklist the rds and rds_tcp modules on hosts that do not require RDS.
Remove ipv6.disable=1 from the kernel command line if RDS with IPv6 addressing is required and cannot be disabled.

Patch Information

The fix guards the RDS IPv6 address check so that it does not access inet6_addr_lst when IPv6 has been disabled at boot. Merged stable commits include 00d5707, 8e48d7a, 9c805e5, a8302e7, and f6787fd. Rebuild and reboot into the patched kernel to activate the fix.

Workarounds

Prevent loading of the RDS transport modules using a modprobe blacklist entry for rds and rds_tcp.
Restrict who can create PF_RDS sockets, for example by using seccomp policies or Linux Security Modules to deny the socket(PF_RDS, ...) call for untrusted workloads.
If RDS is required, avoid booting the host with ipv6.disable=1 so that inet6_addr_lst is properly initialized.

bash

# Configuration example
# Blacklist RDS modules until the kernel is patched
cat <<'EOF' | sudo tee /etc/modprobe.d/blacklist-rds.conf
blacklist rds
blacklist rds_tcp
install rds /bin/true
install rds_tcp /bin/true
EOF

sudo update-initramfs -u
# Verify the modules are not currently loaded
lsmod | grep -E '^rds'