Answer in brief
CVE-2026-68335 records a High severity (CVSS 7.8) vulnerability in rds: drop incoming messages that cross network namespace boundaries. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <1e2e2d9806944fe485824d617c8b7c78116c22db || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <cfb3ce07b705e486e022a2f2b1242b48f13981ff || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <9591042533140dfe6608d9344806d567dcd39d02 || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <0f8690e3869109cd5803ccb400889d20a0b54e0e || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <5521ae71e32a8069ed4ca6e792179dc57bc43ab2 || c827073c95fde388bc65fe5227f944eaf859b9f0 || >=4.17.19 <4.18 | 1e2e2d9806944fe485824d617c8b7c78116c22db, cfb3ce07b705e486e022a2f2b1242b48f13981ff, 9591042533140dfe6608d9344806d567dcd39d02, 0f8690e3869109cd5803ccb400889d20a0b54e0e, 5521ae71e32a8069ed4ca6e792179dc57bc43ab2, 4.18 |
| Linux/Linuxgeneric | 4.18 | Not reported |
| Linux/Linuxgeneric | >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <742ff6f02545212e991cd8b45011e40d2c2ef25a || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <abff41fd928328bbf3dda1140beb2e61fa424ccd || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <03c574112e5d066df0ddce36d7438e850bcf3050 || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <1e2e2d9806944fe485824d617c8b7c78116c22db || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <cfb3ce07b705e486e022a2f2b1242b48f13981ff || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <9591042533140dfe6608d9344806d567dcd39d02 || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <0f8690e3869109cd5803ccb400889d20a0b54e0e || >=c809195f5523dd4d09403bbb1c9732d548aa0d1e <5521ae71e32a8069ed4ca6e792179dc57bc43ab2 || c827073c95fde388bc65fe5227f944eaf859b9f0 || >=4.17.19 <4.18 | 742ff6f02545212e991cd8b45011e40d2c2ef25a, abff41fd928328bbf3dda1140beb2e61fa424ccd, 03c574112e5d066df0ddce36d7438e850bcf3050, 1e2e2d9806944fe485824d617c8b7c78116c22db, cfb3ce07b705e486e022a2f2b1242b48f13981ff, 9591042533140dfe6608d9344806d567dcd39d02, 0f8690e3869109cd5803ccb400889d20a0b54e0e, 5521ae71e32a8069ed4ca6e792179dc57bc43ab2, 4.18 |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rds_find_bound() looks up the destination socket using a global rhashtable keyed solely on (addr, port, scope_id). Network namespaces are not part of the key, so a sender in netns A can deliver an incoming message (inc) to a socket that lives in a different netns B. When this happens, inc->i_conn points to an rds_connection whose c_net is netns A, but the receiving rs lives in netns B. Once the child process that created netns A exits, cleanup_net() calls rds_loop_exit_net() -> rds_loop_kill_conns() -> rds_conn_destroy(), freeing that connection. If the survivor socket in netns B still holds the inc, any subsequent dereference of inc->i_conn is a use-after-free. There are two dangerous sites in rds_clear_recv_queue(): 1. inc->i_conn->c_lcong (offset 88 of freed rds_connection, size 200) read via rds_recv_rcvbuf_delta() -- confirmed by KASAN. 2. inc->i_conn->c_trans->inc_free(inc) (function pointer at offset 80) called via rds_inc_put() when the inc refcount reaches zero -- same race window, potential call-through-freed-object primitive. The bug is reachable from unprivileged user namespaces (CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8. Fix this by rejecting the delivery in rds_recv_incoming() when the socket returned by rds_find_bound() belongs to a different network namespace than the connection that carried the message. Use the existing rds_conn_net() / sock_net() helpers and net_eq() for the comparison.
Quoted source text, attributed separately from HOL analysis.