{"id":"CVE-2026-68290","title":"rds: tcp: unregister sysctl before tearing down listen socket","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: unregister sysctl before tearing down listen socket\n\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= de8d6de0ee27be4b2b1e5b06f04aeacbabbba492 < 80fffed08dc1c10e971066941d2daa56253f1552","Linux >= 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c < 16df2d154ec82e2f7e7585b4fa154751ba37729a","Linux >= 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c < 3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d","Linux >= 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c < 167e54c703ccd4fa028feb568b0d1002020cff86","Linux >= 6.12.10 < 6.12.101","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:46:38.665842Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:06.461Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68290","references":[{"url":"https://git.kernel.org/stable/c/80fffed08dc1c10e971066941d2daa56253f1552"},{"url":"https://git.kernel.org/stable/c/16df2d154ec82e2f7e7585b4fa154751ba37729a"},{"url":"https://git.kernel.org/stable/c/3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d"},{"url":"https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86"}],"tags":["cve.org"],"epss":0.00125,"epssPercentile":0.01985,"ingestedAt":"2026-10-16T17:24:46.855Z","slug":"CVE-2026-68290","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: unregister sysctl before tearing down listen socket\n\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering the per-netns sysctl table.  Since\nrds_tcp_skbuf_handler() derives the netns from\nrtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with\nnetns teardown and dereference the freed socket/sk.\n\nKASAN reports the race as:\n\n  BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0\n  rds_tcp_skbuf_handler              net/rds/tcp.c:721\n  proc_sys_call_handler              fs/proc/proc_sysctl.c\n  vfs_write                          fs/read_write.c\n  __x64_sys_pwrite64                 fs/read_write.c\n\nFix this by unregistering the RDS TCP sysctl table before calling\nrds_tcp_kill_sock().  unregister_net_sysctl_table() prevents new sysctl\nhandlers from starting and waits for in-flight handlers to finish, so\nthe listen socket can then be released safely. The fix was tested\nagainst the linked reproducer.\n\n## Affected\n\n- `Linux >= de8d6de0ee27be4b2b1e5b06f04aeacbabbba492 < 80fffed08dc1c10e971066941d2daa56253f1552`\n- `Linux >= 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c < 16df2d154ec82e2f7e7585b4fa154751ba37729a`\n- `Linux >= 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c < 3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d`\n- `Linux >= 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c < 167e54c703ccd4fa028feb568b0d1002020cff86`\n- `Linux >= 6.12.10 < 6.12.101`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}