CVE-2026-68290 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
rds: tcp: unregister sysctl before tearing down listen socket
rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since rds_tcp_skbuf_handler() derives the netns from rtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with netns teardown and dereference the freed socket/sk.
KASAN reports the race as:
BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0 rds_tcp_skbuf_handler net/rds/tcp.c:721 proc_sys_call_handler fs/proc/proc_sysctl.c vfs_write fs/read_write.c __x64_sys_pwrite64 fs/read_write.c
Fix this by unregistering the RDS TCP sysctl table before calling rds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl handlers from starting and waits for in-flight handlers to finish, so the listen socket can then be released safely. The fix was tested against the linked reproducer.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described represents a critical race condition in the Linux kernel's Reliable Datagram Sockets (RDS) TCP implementation that stems from improper ordering of resource cleanup operations during network namespace teardown. This flaw exists within the rds_tcp_exit_net() function where the system attempts to free network resources in an incorrect sequence, creating a window where concurrent system calls can access already freed memory structures.
The technical root cause involves a fundamental timing issue between two critical operations within the RDS TCP subsystem's cleanup process. When a network namespace is being torn down, the function first invokes rds_tcp_kill_sock() to free the per-netns RDS TCP listen socket and subsequently calls unregister_net_sysctl_table() to remove the sysctl table registration. However, this sequence creates a dangerous race condition because the sysctl handler rds_tcp_skbuf_handler() depends on retrieving network namespace information from the freed socket structure through rtn->rds_tcp_listen_sock->sk. This dependency means that even after the socket has been freed and its memory released back to the kernel's slab allocator, concurrent system calls attempting to modify sysctl parameters can still reference the deallocated memory.
The vulnerability manifests as a use-after-free error detected by Kernel Address Sanitizer (KASAN), specifically in the rds_tcp_skbuf_handler function at line 721 of net/rds/tcp.c. The call stack shows how a concurrent proc_sys_call_handler invocation from fs/proc/proc_sysctl.c leads to the freed socket being accessed through the vfs_write and __x64_sys_pwrite64 paths, ultimately resulting in memory corruption. This represents a classic software security vulnerability where improper resource management creates exploitable conditions for memory safety violations.
The operational impact of this vulnerability extends beyond simple system stability issues into potential security implications. While the immediate effect is a kernel crash due to memory corruption, the underlying race condition could theoretically be exploited by malicious actors to achieve privilege escalation or denial-of-service attacks against systems running affected kernel versions. The vulnerability affects systems using RDS TCP functionality and demonstrates poor adherence to proper resource cleanup ordering principles that are fundamental to kernel security design.
The fix implemented addresses this issue by reversing the order of operations in rds_tcp_exit_net() to first unregister the netns sysctl table before proceeding with socket cleanup. This approach follows established kernel patterns where unregister_net_sysctl_table() provides crucial synchronization guarantees by preventing new sysctl handler invocations and waiting for any ongoing handlers to complete their execution. This ensures that all references to the freed socket structure are resolved before memory deallocation occurs, eliminating the race condition entirely.
This vulnerability aligns with CWE-367, which specifically addresses Time-of-Check to Time-of-Use (TOCTOU) races, and demonstrates principles relevant to ATT&CK technique T1068 by creating conditions that could enable privilege escalation through kernel memory corruption. The fix exemplifies proper kernel resource management practices and follows the principle of least privilege in system design, where cleanup operations are sequenced to prevent concurrent access to freed resources. The solution represents a defensive programming approach that prevents race conditions through proper synchronization mechanisms rather than attempting to detect or recover from corrupted states after they occur.