CVE-2026-68335: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68335 Overview

CVE-2026-68335 is a use-after-free vulnerability in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. The flaw exists because rds_find_bound() uses a global rhashtable keyed only on (addr, port, scope_id), omitting the network namespace from the lookup key. A sender in one network namespace can deliver a message to a socket in a different namespace, leaving inc->i_conn pointing to a connection that may be freed by cleanup_net() when the originating namespace is torn down. The bug is reachable from unprivileged user namespaces via CLONE_NEWUSER + CLONE_NEWNET, a combination available since Linux 3.8.

Critical Impact
Local unprivileged users can trigger a use-after-free in the kernel RDS layer, enabling potential privilege escalation or denial of service on affected Linux systems.

Affected Products

Linux kernel builds with the RDS (Reliable Datagram Sockets) subsystem enabled
Distributions permitting unprivileged user namespaces (CLONE_NEWUSER) since Linux 3.8
Kernel versions prior to the fixes referenced in commits 0f8690e, 1e2e2d9, 5521ae7, 9591042, and cfb3ce0

Discovery Timeline

2026-08-10 - CVE-2026-68335 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68335

Vulnerability Analysis

The vulnerability resides in the RDS receive path. rds_find_bound() performs a global hashtable lookup that ignores the network namespace of the socket, so an inc (incoming message) originating from a connection in netns A can be delivered to a receiving socket rs living in netns B. The mismatched linkage becomes dangerous when the child process that created netns A exits. At that point, cleanup_net() invokes rds_loop_exit_net() → rds_loop_kill_conns() → rds_conn_destroy(), freeing the rds_connection object referenced by inc->i_conn. The surviving socket in netns B still holds a reference to the freed connection.

Root Cause

The root cause is an incomplete lookup key in the RDS binding table. Network namespaces are not part of (addr, port, scope_id), so cross-namespace delivery is possible by design of the lookup. The RDS connection lifecycle is tied to the network namespace that created it, while socket lifetime is independent, producing a lifetime mismatch that becomes a use-after-free when the connection is freed first.

Attack Vector

An unprivileged local attacker creates a user namespace and a network namespace, binds RDS sockets, and sends messages that get delivered to sockets in another namespace. After the attacker-controlled namespace exits and its RDS connections are destroyed, two dereference sites in rds_clear_recv_queue() become dangerous: a read of inc->i_conn->c_lcong via rds_recv_rcvbuf_delta() (confirmed by KASAN), and an indirect call through inc->i_conn->c_trans->inc_free(inc) invoked from rds_inc_put() when the reference count reaches zero. The function-pointer call site provides a call-through-freed-object primitive with potential for kernel code execution.

See the upstream fixes for technical details: Kernel Patch 0f8690e, Kernel Patch 1e2e2d9, and Kernel Patch cfb3ce0.

Detection Methods for CVE-2026-68335

Indicators of Compromise

KASAN reports referencing rds_recv_rcvbuf_delta, rds_clear_recv_queue, or rds_inc_put with use-after-free tags on rds_connection objects.
Unexpected kernel oops or general protection faults in the RDS receive path following network namespace teardown.
Processes creating combined CLONE_NEWUSER and CLONE_NEWNET namespaces while loading or using the rds module.

Detection Strategies

Enable KASAN on test kernels to catch dereferences of freed rds_connection structures during namespace exit.
Audit unshare() and clone() calls with CLONE_NEWUSER | CLONE_NEWNET flags from non-root users, correlated with RDS socket activity.
Alert on modprobe rds or rds_tcp load events on hosts that do not require RDS.

Monitoring Recommendations

Collect kernel ring buffer logs (dmesg, /var/log/kern.log) centrally and search for rds_ stack frames in oops traces.
Track user-namespace creation via auditd rules on the unshare and clone syscalls.
Monitor kernel module load events for rds, rds_tcp, and rds_rdma on production endpoints.

How to Mitigate CVE-2026-68335

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry and rebase distribution kernels to a fixed release.
Blacklist the rds, rds_tcp, and rds_rdma modules on systems that do not use Reliable Datagram Sockets.
Restrict creation of unprivileged user namespaces where operational policy allows, using kernel.unprivileged_userns_clone=0 or the equivalent sysctl on the distribution.

Patch Information

The fix rejects delivery in rds_recv_incoming() when the socket returned by rds_find_bound() belongs to a different network namespace than the connection that carried the message. The comparison uses the existing rds_conn_net() and sock_net() helpers together with net_eq(). Fixes are available in the following stable kernel commits: Kernel Patch 0f8690e, Kernel Patch 1e2e2d9, Kernel Patch 5521ae7, Kernel Patch 9591042, and Kernel Patch cfb3ce0.

Workarounds

Prevent the rds module family from loading by adding install rds /bin/true to a file under /etc/modprobe.d/.
Disable unprivileged user namespaces on hosts that do not require container workloads.
Enforce seccomp or AppArmor profiles that block unshare(CLONE_NEWUSER|CLONE_NEWNET) for untrusted workloads.

bash

# Configuration example: block the RDS module family and disable unprivileged user namespaces
echo 'install rds /bin/true'      | sudo tee /etc/modprobe.d/blacklist-rds.conf
echo 'install rds_tcp /bin/true'  | sudo tee -a /etc/modprobe.d/blacklist-rds.conf
echo 'install rds_rdma /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-rds.conf

# Restrict unprivileged user namespaces (Debian/Ubuntu)
sudo sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/90-userns.conf