HIGH
rds TCP Socket Race
CVE-2026-23419
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net/rds: Fix circular locking dependency in rds_tcp_tune syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock: ====================================================== WARNING: possible circular locking dependency detected ====================================================== kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x6f0 but task is already holding lock: ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: rds_tcp_tune+0xd7/0x930 The issue occurs because sk_net_refcnt_upgrade() performs memory allocation (via get_net_track() -> ref_tracker_alloc()) while the socket lock is held, creating a circular dependency with fs_reclaim. Fix this by moving sk_net_refcnt_upgrade() outside the socket lock critical section. This is safe because the fields modified by the sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not accessed by any concurrent code path at this point. v2: - Corrected fixes tag - check patch line wrap nits - ai commentary nits
02KernelScan AI Analysis
Risk summary
This vulnerability can cause system deadlocks when RDS TCP sockets are used, leading to denial of service. While it requires local access to trigger, it doesn't need special privileges and can affect system stability in environments using RDS networking.
Vulnerability analysis
Summary: A circular locking dependency vulnerability in the RDS (Reliable Datagram Sockets) TCP implementation where sk_net_refcnt_upgrade() performs memory allocation while holding a socket lock, creating a deadlock scenario with the filesystem reclaim subsystem.
Root Cause: The rds_tcp_tune() function calls sk_net_refcnt_upgrade() while holding the socket lock (sk_lock). The sk_net_refcnt_upgrade() function internally performs memory allocation via get_net_track() -> ref_tracker_alloc() with GFP_KERNEL flags, which can trigger filesystem reclaim. This creates a circular dependency: socket lock -> fs_reclaim -> potential socket lock acquisition during memory reclaim operations.
Attack Surface: This vulnerability affects systems using RDS over TCP networking. It requires local access to trigger RDS socket operations, but does not require elevated privileges. The circular locking dependency can lead to system deadlocks, causing denial of service conditions.
Fix Mechanism: The patch resolves the issue by reordering operations to call sk_net_refcnt_upgrade() before acquiring the socket lock. This eliminates the circular dependency by ensuring memory allocation happens outside the critical section. The fix is safe because the fields modified by sk_net_refcnt_upgrade() (sk_net_refcnt and ns_tracker) are not accessed concurrently at this point in the code path.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.18 | 5.18 | 8babb2714033 |
| 6.12 | 6.12.77 | 6ce948fa5459 |
| 6.18 | 6.18.17 | 026bbaeeab9e |
| 6.19 | 6.19.7 | 6a877ececd6d |
| 6.6 | 6.6.130 | 8519e6883a94 |
| mainline | 7.0 | — |