CVE-2026-68290: rds: tcp: unregister sysctl before tearing down listen socket
In the Linux kernel, the following vulnerability has been resolved:
rds: tcp: unregister sysctl before tearing down listen socket
rdstcpexitnet() frees the per-netns RDS TCP listen socket via rdstcpkillsock() before unregistering the per-netns sysctl table. Since rdstcpskbufhandler() derives the netns from rtn->rdstcplistensock->sk, a concurrent sysctl write can race with netns teardown and dereference the freed socket/sk.
KASAN reports the race as:
BUG: KASAN: slab-use-after-free in rdstcpskbufhandler+0x2aa/0x2e0 rdstcpskbufhandler net/rds/tcp.c:721 procsyscallhandler fs/proc/procsysctl.c vfswrite fs/readwrite.c x64syspwrite64 fs/readwrite.c
Fix this by unregistering the RDS TCP sysctl table before calling rdstcpkillsock(). unregisternetsysctltable() prevents new sysctl handlers from starting and waits for in-flight handlers to finish, so the listen socket can then be released safely. The fix was tested against the linked reproducer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68290?
CVE-2026-68290 has a risk rating of 27.
How do I fix CVE-2026-68290?
To fix CVE-2026-68290, you should update the Linux kernel to the latest version where this vulnerability has been patched.
What type of vulnerability is CVE-2026-68290?
CVE-2026-68290 is classified as a Use After Free vulnerability.
What systems are affected by CVE-2026-68290?
CVE-2026-68290 affects systems running affected versions of the Linux kernel with RDS TCP support.
What is the impact of CVE-2026-68290?
The impact of CVE-2026-68290 could potentially lead to denial of service or arbitrary code execution due to improper handling of memory.