CVE-2026-23419

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: Fix circular locking dependency in rds_tcp_tune

syzbot reported a circular locking dependency in rds_tcp_tune() where

sk_net_refcnt_upgrade() is called while holding the socket lock:

======================================================

WARNING: possible circular locking dependency detected

======================================================

kworker/u10:8/15040 is trying to acquire lock:

ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},

at: __kmalloc_cache_noprof+0x4b/0x6f0

but task is already holding lock:

ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},

at: rds_tcp_tune+0xd7/0x930

The issue occurs because sk_net_refcnt_upgrade() performs memory

allocation (via get_net_track() -> ref_tracker_alloc()) while the

socket lock is held, creating a circular dependency with fs_reclaim.

Fix this by moving sk_net_refcnt_upgrade() outside the socket lock

critical section. This is safe because the fields modified by

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References