Skip to main content

Linux EUVDEUVD-2026-18636

| CVE-2026-23419 MEDIUM
Improper Locking (CWE-667)
2026-04-03 Linux GHSA-x244-gjj6-jc73
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-667
ASVS 5.0
V15 - Secure Coding and Architecture Proper locking
Impact

Despite missing CVSS/EPSS metrics in the input data, the risk profile is moderate-to-high for kernel stability. This is a deadlock/denial-of-service vulnerability rather than a data confidentiality or integrity issue, evidenced by syzbot's deterministic reproduction and the circular dependency warning (not a memory corruption or privilege escalation). The real-world impact depends on workload characteristics: systems heavily using RDS TCP connections combined with concurrent memory pressure and socket tuning operations are at higher risk of unexpected kernel hangs. The fix is minimal and low-risk (reordering lock acquisition), suggesting this is a genuine concurrency bug rather than a design flaw. Kernel developers and distributions tracking syzbot findings should prioritize this as a stability patch; however, it does not warrant emergency response like RCE or privilege escalation vulnerabilities would. The fact that five stable kernel commits reference this fix indicates it has been backported across multiple kernel versions.
Exploit ScenarioDerived

A local unprivileged user or system component managing RDS TCP connections triggers the vulnerability by initiating socket tuning (via setsockopt or similar operations) while concurrent memory allocation pressure is high. The kernel's rds_tcp_tune() function acquires the socket lock, then attempts sk_net_refcnt_upgrade() which allocates memory. If the memory allocator is under pressure and requests fs_reclaim locks, while another thread simultaneously holds fs_reclaim and waits for socket locks, the circular dependency causes a kernel deadlock. Syzbot's reproduction demonstrates this is triggerable without special privileges, making it a denial-of-service vector on multi-tenant systems or systems with untrusted workloads.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 03, 2026

Linux kernel RDS TCP subsystem resolves circular locking dependency in rds_tcp_tune() function where socket lock contention with fs_reclaim memory allocation creates deadlock potential. The vulnerability affects all Linux kernel versions with the vulnerable code path in net/rds/tcp.c; the fix relocates sk_net_refcnt_upgrade() outside the socket lock critical section to eliminate the circular lock dependency without compromising synchronization semantics.

RemediationAI

Apply the kernel patch from the referenced stable commits. The fix is available in upstream Linux via commit 8babb271403378ba6836f6c8599c5313d0e2355d and has been backported to stable kernel branches via commits 8519e6883a942e510f33a0e634e27bcc3a844a40, 6ce948fa54599f369ff7fe8b793a6aae4b0762b2, 026bbaeeab9e04534ee58882b6447300629b42f6, and 6a877ececd6daa002a9a0002cd0fbca6592a9244 (accessible via https://git.kernel.org/stable/). Affected Linux distributions should update to a kernel version that includes one of these commits. No workaround is available short of disabling RDS TCP support or avoiding heavy socket tuning operations under memory pressure. Systems experiencing kernel deadlocks related to rds_tcp_tune should immediately prioritize kernel update after testing in a non-production environment.

Affected VersionsENISA

Linux patch: 6.12.77
Linux 3a58f13a881ed351198ffab4cf9953cf19d2ab3a <6a877ececd6daa002a9a0002cd0fbca6592a9244
Linux 5.18
Linux patch: 6.6.130
Linux 3a58f13a881ed351198ffab4cf9953cf19d2ab3a <6ce948fa54599f369ff7fe8b793a6aae4b0762b2
Linux 3a58f13a881ed351198ffab4cf9953cf19d2ab3a <8babb271403378ba6836f6c8599c5313d0e2355d
Linux patch: 6.19.7
Linux patch: 6.18.17
Linux 2a6efabed754c9dcf27e6def71317b374f58a852
Linux patch: 7.0-rc3
Linux 3a58f13a881ed351198ffab4cf9953cf19d2ab3a <8519e6883a942e510f33a0e634e27bcc3a844a40
Linux patch: 0
Linux 3a58f13a881ed351198ffab4cf9953cf19d2ab3a <026bbaeeab9e04534ee58882b6447300629b42f6

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the Linux kernel's Reliable Datagram Sockets (RDS) TCP implementation, specifically in the rds_tcp_tune() function that handles socket tuning operations. The root cause is a classic circular locking dependency (CWE-833) where the function holds a socket lock (k-sk_lock-AF_INET6) while calling sk_net_refcnt_upgrade(), which internally invokes get_net_track() and ref_tracker_alloc() that perform kernel memory allocation. This memory allocation path triggers fs_reclaim lock acquisition, creating a lock ordering cycle: socket lock → memory allocation → fs_reclaim, while other code paths may reverse this ordering. The fix recognizes that sk_net_refcnt and ns_tracker fields modified by sk_net_refcnt_upgrade() are not accessed concurrently at that point, allowing safe relocation of this call outside the socket lock's critical section.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

7
Severity Changed
Jul 24, 2026 - 21:22 NVD
HIGH MEDIUM
CVSS changed
Jul 24, 2026 - 21:22 NVD
7.5 (HIGH) 5.5 (MEDIUM)
Severity Changed
Apr 27, 2026 - 14:22 NVD
MEDIUM HIGH
CVSS changed
Apr 27, 2026 - 14:22 NVD
5.5 (MEDIUM) 7.5 (HIGH)
CVSS changed
Apr 24, 2026 - 15:22 NVD
5.5 (MEDIUM)
Patch available
Apr 16, 2026 - 05:29 EUVD
6a877ececd6daa002a9a0002cd0fbca6592a9244,6ce948fa54599f369ff7fe8b793a6aae4b0762b2,8babb271403378ba6836f6c8599c5313d0e2355d
CVE Published
Apr 03, 2026 - 13:24 nvd
N/A

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net/rds: Fix circular locking dependency in rds_tcp_tune

syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock:

============ WARNING: possible circular locking dependency detected ============ kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x6f0

but task is already holding lock: ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: rds_tcp_tune+0xd7/0x930

The issue occurs because sk_net_refcnt_upgrade() performs memory allocation (via get_net_track() -> ref_tracker_alloc()) while the socket lock is held, creating a circular dependency with fs_reclaim.

Fix this by moving sk_net_refcnt_upgrade() outside the socket lock critical section. This is safe because the fields modified by the sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not accessed by any concurrent code path at this point.

v2:

  • Corrected fixes tag
  • check patch line wrap nits
  • ai commentary nits

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-667 – Improper Locking

View all
CVE-2019-10072 HIGH
7.5
CVE-2025-43510 HIGH POC
7.8
CVE-2019-5886 CRITICAL POC
9.8
CVE-2020-13246 HIGH POC
7.5
CVE-2019-15513 HIGH POC
7.5
CVE-2019-11599 HIGH POC
7.0
CVE-2023-21400 MEDIUM POC
6.7
CVE-2021-20291 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.127 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.114 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.144 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.116 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.161 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.107 Affected
Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-GCE-3P Affected
SUSE Linux Micro 6.0 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23419 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/355094 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21114/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21123/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21129/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21131/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21230/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21237/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21241/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21255/ REF https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6 REF https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244 REF https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2 REF https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40 REF https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d REF https://git.kernel.org/stable/c/ce5be6703afd2ac2ff7dabd397137d71d22d4bc3

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy