Skip to main content

Linux Kernel EUVDEUVD-2026-55391

| CVE-2026-68290 HIGH
2026-08-10 Linux GHSA-j86x-f498-4jqp
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requiring precise concurrent timing of sysctl write during netns teardown warrants AC:H; local access and low privilege confirmed by attack vector and sysctl write requirement.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.8 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:18 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:02 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rds: tcp: unregister sysctl before tearing down listen socket

rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since rds_tcp_skbuf_handler() derives the netns from rtn->rds_tcp_listen_sock->sk, a concurrent sysctl write can race with netns teardown and dereference the freed socket/sk.

KASAN reports the race as:

BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0 rds_tcp_skbuf_handler net/rds/tcp.c:721 proc_sys_call_handler fs/proc/proc_sysctl.c vfs_write fs/read_write.c __x64_sys_pwrite64 fs/read_write.c

Fix this by unregistering the RDS TCP sysctl table before calling rds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl handlers from starting and waits for in-flight handlers to finish, so the listen socket can then be released safely. The fix was tested against the linked reproducer.

AnalysisAI

Use-after-free in the Linux kernel's RDS TCP subsystem allows a local low-privileged attacker to corrupt kernel memory during network namespace teardown, potentially achieving full privilege escalation to root. The flaw exists across multiple stable kernel branches (6.12.x before 6.12.101, 6.18.x before 6.18.42, 7.1.x before 7.1.6), with exploitation limited to systems where the RDS TCP module is loaded - a non-default configuration primarily found in Oracle RAC and HPC environments. Kernel patches have been merged across all affected stable branches; no public exploit exists and EPSS sits at 0.17%, indicating low current exploitation probability.

Technical ContextAI

The vulnerability resides in the RDS (Reliable Datagram Sockets) over TCP subsystem within the Linux kernel, specifically in the network namespace (netns) teardown path. The function rds_tcp_exit_net() incorrectly frees the per-netns RDS TCP listen socket via rds_tcp_kill_sock() before unregistering the associated per-netns sysctl table. The sysctl handler rds_tcp_skbuf_handler() derives its netns pointer by dereferencing rtn->rds_tcp_listen_sock->sk; if a sysctl write operation is concurrently in flight during netns destruction, this handler accesses the already-freed socket structure, constituting a classic slab-use-after-free (CWE-416) triggered by a time-of-check/time-of-use race (CWE-362). The KASAN report confirms the race at net/rds/tcp.c:721, reachable via the pwrite64 → vfs_write → proc_sys_call_handler call chain. The fix reorders teardown so unregister_net_sysctl_table() runs first, which both prevents new handlers from starting and drains in-flight ones before the socket is released. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary remediation is upgrading to a patched kernel version: 6.12.101 or later for the 6.12 stable series, 6.18.42 or later for the 6.18 series, or 7.1.6 or later for the 7.1 series. Stable-branch patch commits are available at https://git.kernel.org/stable/c/80fffed08dc1c10e971066941d2daa56253f1552, https://git.kernel.org/stable/c/16df2d154ec82e2f7e7585b4fa154751ba37729a, https://git.kernel.org/stable/c/3aa13fe0c1bb7bc5312f878e61523e5d8cf3f85d, and https://git.kernel.org/stable/c/167e54c703ccd4fa028feb568b0d1002020cff86. As an interim compensating control where live patching is not possible, unloading the RDS TCP module (modprobe -r rds_tcp rds) eliminates the attack surface entirely; note this will terminate any active RDS sessions and break Oracle RAC connectivity, so is unsuitable as a long-term measure in production RAC environments. Restricting write access to /proc/sys/net/rds/ entries via filesystem ACLs, SELinux policy, or seccomp filters reduces the concurrent write opportunity but does not close the race window if the attacker controls a process with legitimate sysctl access. Distribution vendors are expected to backport the fix; check your vendor's errata channel for kernel update packages.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55391 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy