CVE-2026-68290

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is triggered by a local write() /pwrite64() to the per-netns sysctl file /proc/sys/net/rds/tcp/rds_tcp_{snd,rcv}buf racing with network namespace teardown; no network traffic reaches the vulnerable handler, so local syscall access is required.

AC:LAttack complexity, low

Although this is a race, the attacker controls both sides: they create the netns, keep the sysctl fd open, choose when the netns is destroyed, and issue the concurrent sysctl write in a tight loop, so the race can be retried indefinitely until won.

PR:LPrivileges required, low

Only an unprivileged local account is needed: unshare -Urn yields CAP_NET_ADMIN over the new netns's user_ns, and net_ctl_permissions()/net_ctl_set_ownership() then grant that user write access to the RDS TCP sysctls, while the rds_tcp module is autoloaded by an unprivileged AF_RDS socket.

UI:NUser interaction, none

The attacker performs every step itself — namespace creation, opening the sysctl file, triggering teardown and writing — with no action required from any other user or administrator.

S:UScope, unchanged

The use-after-free occurs on kernel slab objects belonging to the same kernel security authority; there is no crossing of a VM, IOMMU or other security boundary.

C:HConfidentiality impact, high

The handler reads the freed listen socket and then dereferences lsock->sk and sock_net(sk); by spraying the freed socket/sk slabs the attacker can steer these dereferences to chosen addresses, turning the use-after-free read into a kernel memory disclosure primitive.

I:HIntegrity impact, high

Reallocating the freed struct socket/sk with attacker-controlled data lets the attacker supply a bogus struct net pointer that drives rds_tcp_sysctl_reset()/rds_conn_path_drop() over the global RDS connection list, corrupting kernel state and giving the usual UAF path toward control-flow hijack.

A:HAvailability impact, high

The confirmed KASAN slab-use-after-free on the freed listen socket readily oopses or panics the kernel, and the race can be repeated by an unprivileged user until it hits, giving a reliable denial of service.