CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune
In the Linux kernel, the following vulnerability has been resolved:
net/rds: Fix circular locking dependency in rdstcptune
syzbot reported a circular locking dependency in rdstcptune() where sknetrefcntupgrade() is called while holding the socket lock:
====================================================== WARNING: possible circular locking dependency detected ====================================================== kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fsreclaim){+.+.}-{0:0}, at: kmalloccachenoprof+0x4b/0x6f0
but task is already holding lock: ffff88805a3c1ce0 (k-sklock-AFINET6){+.+.}-{0:0}, at: rdstcptune+0xd7/0x930
The issue occurs because sknetrefcntupgrade() performs memory allocation (via getnettrack() -> reftrackeralloc()) while the socket lock is held, creating a circular dependency with fsreclaim.
Fix this by moving sknetrefcntupgrade() outside the socket lock critical section. This is safe because the fields modified by the sknetrefcntupgrade() call (sknetrefcnt, nstracker) are not accessed by any concurrent code path at this point.
v2: - Corrected fixes tag - check patch line wrap nits - ai commentary nits
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel are in scope, specifically where the RDS TCP tuning path can be reached. The issue is network-reachable according to the supplied vector and requires no privileges or user interaction.
What is the expected security impact?
An attacker can trigger the circular locking condition remotely with low attack complexity. The reported impact is an availability impact only; no confidentiality or integrity impact is indicated.
What should be done if patching is not immediately possible?
The fix moves sk_net_refcnt_upgrade() outside the socket-lock critical section, preventing its memory allocation path from running while the socket lock is held. The supplied data does not provide an alternative mitigation or configuration workaround.