CVE-2026-68335: rds: drop incoming messages that cross network namespace boundaries

In the Linux kernel, the following vulnerability has been resolved:

rds: drop incoming messages that cross network namespace boundaries

rdsfindbound() looks up the destination socket using a global rhashtable keyed solely on (addr, port, scopeid). Network namespaces are not part of the key, so a sender in netns A can deliver an incoming message (inc) to a socket that lives in a different netns B.

When this happens, inc->iconn points to an rdsconnection whose cnet is netns A, but the receiving rs lives in netns B. Once the child process that created netns A exits, cleanupnet() calls rdsloopexitnet() -> rdsloopkillconns() -> rdsconndestroy(), freeing that connection. If the survivor socket in netns B still holds the inc, any subsequent dereference of inc->iconn is a use-after-free.

There are two dangerous sites in rdsclearrecvqueue(): 1. inc->iconn->clcong (offset 88 of freed rdsconnection, size 200) read via rdsrecvrcvbufdelta() -- confirmed by KASAN. 2. inc->iconn->ctrans->incfree(inc) (function pointer at offset 80) called via rdsincput() when the inc refcount reaches zero -- same race window, potential call-through-freed-object primitive.

The bug is reachable from unprivileged user namespaces (CLONENEWUSER + CLONENEWNET), available since Linux 3.8.

Fix this by rejecting the delivery in rdsrecvincoming() when the socket returned by rdsfindbound() belongs to a different network namespace than the connection that carried the message. Use the existing rdsconnnet() / socknet() helpers and neteq() for the comparison.