CVE-2026-97476

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rds: filter RDS_INFO_* getsockopt by caller's netns

The RDS_INFO_* family of getsockopt(2) options reads several

file-scope global lists that are not per-netns:

rds_sock_info / rds6_sock_info,

rds_sock_inc_info / rds6_sock_inc_info -> rds_sock_list

rds_tcp_tc_info / rds6_tcp_tc_info -> rds_tcp_tc_list

rds_conn_info / rds6_conn_info,

rds_conn_message_info_cmn (for the *_SEND_MESSAGES and

*_RETRANS_MESSAGES variants),

rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS)

-> rds_conn_hash[]

The handlers do not filter by the caller's network namespace.

rds_info_getsockopt() has no netns or capable() check, and

rds_create() has no capable() check, so AF_RDS is reachable from

an unprivileged user namespace. As a result, an unprivileged

caller in a fresh user_ns plus netns can read the bound address

and sock inode of every RDS socket on the hos

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References