{"cve":"CVE-2026-68335","nvd":{"published":"2026-08-10T13:20:23.863","modified":"2026-10-19T22:17:13.720","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: drop incoming messages that cross network namespace boundaries\n\nrds_find_bound() looks up the destination socket using a global\nrhashtable keyed solely on (addr, port, scope_id).  Network namespaces\nare not part of the key, so a sender in netns A can deliver an incoming\nmessage (inc) to a socket that lives in a different netns B.\n\nWhen this happens, inc->i_conn points to an rds_connection whose c_net\nis netns A, but the receiving rs lives in netns B.  Once the child\nprocess that created netns A exits, cleanup_net() calls\nrds_loop_exit_net() -> rds_loop_kill_conns() -> rds_conn_destroy(),\nfreeing that connection.  If the survivor socket in netns B still holds\nthe inc, any subsequent dereference of inc->i_conn is a use-after-free.\n\nThere are two dangerous sites in rds_clear_recv_queue():\n  1. inc->i_conn->c_lcong (offset 88 of freed rds_connection, size 200)\n     read via rds_recv_rcvbuf_delta() -- confirmed by KASAN.\n  2. inc->i_conn->c_trans->inc_free(inc) (function pointer at offset 80)\n     called via rds_inc_put() when the inc refcount reaches zero -- same\n     race window, potential call-through-freed-object primitive.\n\nThe bug is reachable from unprivileged user namespaces\n(CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8.\n\nFix this by rejecting the delivery in rds_recv_incoming() when the\nsocket returned by rds_find_bound() belongs to a different network\nnamespace than the connection that carried the message.  Use the\nexisting rds_conn_net() / sock_net() helpers and net_eq() for the\ncomparison.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/03c574112e5d066df0ddce36d7438e850bcf3050","https://git.kernel.org/stable/c/0f8690e3869109cd5803ccb400889d20a0b54e0e","https://git.kernel.org/stable/c/1e2e2d9806944fe485824d617c8b7c78116c22db","https://git.kernel.org/stable/c/5521ae71e32a8069ed4ca6e792179dc57bc43ab2","https://git.kernel.org/stable/c/742ff6f02545212e991cd8b45011e40d2c2ef25a"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:56:58.798400159+00:00"},"epss":{"cve":"CVE-2026-68335","score":0.00135,"percentile":0.02955,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}