CVE-2026-68335

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

rds: drop incoming messages that cross network namespace boundaries

rds_find_bound() looks up the destination socket using a global

rhashtable keyed solely on (addr, port, scope_id). Network namespaces

are not part of the key, so a sender in netns A can deliver an incoming

message (inc) to a socket that lives in a different netns B.

When this happens, inc->i_conn points to an rds_connection whose c_net

is netns A, but the receiving rs lives in netns B. Once the child

process that created netns A exits, cleanup_net() calls

rds_loop_exit_net() -> rds_loop_kill_conns() -> rds_conn_destroy(),

freeing that connection. If the survivor socket in netns B still holds

the inc, any subsequent dereference of inc->i_conn is a use-after-free.

There are two dangerous sites in rds_clear_recv_queue():

1. inc->i_conn->c_lcong (offset 88 of freed rds_connection, size 200)

read via rds_recv_rcvbuf_delta() -- confirmed by KAS

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References