{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-68335",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-68335"
  ],
  "published": "2026-08-10T12:08:00Z",
  "summary": "rds: drop incoming messages that cross network namespace boundaries",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: drop incoming messages that cross network namespace boundaries\n\nrds_find_bound() looks up the destination socket using a global\nrhashtable keyed solely on (addr, port, scope_id).  Network namespaces\nare not part of the key, so a sender in netns A can deliver an incoming\nmessage (inc) to a socket that lives in a different netns B.\n\nWhen this happens, inc->i_conn points to an rds_connection whose c_net\nis netns A, but the receiving rs lives in netns B.  Once the child\nprocess that created netns A exits, cleanup_net() calls\nrds_loop_exit_net() -> rds_loop_kill_conns() -> rds_conn_destroy(),\nfreeing that connection.  If the survivor socket in netns B still holds\nthe inc, any subsequent dereference of inc->i_conn is a use-after-free.\n\nThere are two dangerous sites in rds_clear_recv_queue():\n  1. inc->i_conn->c_lcong (offset 88 of freed rds_connection, size 200)\n     read via rds_recv_rcvbuf_delta() -- confirmed by KASAN.\n  2. inc->i_conn->c_trans->inc_free(inc) (function pointer at offset 80)\n     called via rds_inc_put() when the inc refcount reaches zero -- same\n     race window, potential call-through-freed-object primitive.\n\nThe bug is reachable from unprivileged user namespaces\n(CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8.\n\nFix this by rejecting the delivery in rds_recv_incoming() when the\nsocket returned by rds_find_bound() belongs to a different network\nnamespace than the connection that carried the message.  Use the\nexisting rds_conn_net() / sock_net() helpers and net_eq() for the\ncomparison.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.183",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68335"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/742ff6f02545212e991cd8b45011e40d2c2ef25a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/abff41fd928328bbf3dda1140beb2e61fa424ccd"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/03c574112e5d066df0ddce36d7438e850bcf3050"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1e2e2d9806944fe485824d617c8b7c78116c22db"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/cfb3ce07b705e486e022a2f2b1242b48f13981ff"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9591042533140dfe6608d9344806d567dcd39d02"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0f8690e3869109cd5803ccb400889d20a0b54e0e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5521ae71e32a8069ed4ca6e792179dc57bc43ab2"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-19T16:47:12Z"
  }
}