CVE-2026-43226

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: No shortcut out of RDS_CONN_ERROR

RDS connections carry a state "rds_conn_path::cp_state"

and transitions from one state to another and are conditional

upon an expected state: "rds_conn_path_transition."

There is one exception to this conditionality, which is

"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"

regardless of what state the condition is currently in.

But as soon as a connection enters state "RDS_CONN_ERROR",

the connection handling code expects it to go through the

shutdown-path.

The RDS/TCP multipath changes added a shortcut out of

"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"

via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").

A subsequent "rds_tcp_reset_callbacks" can then transition

the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.

That'll trip up "rds_conn_init_shutdown", which was

never adjusted to handle "RDS_CONN_RESETTING" and sub

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References