CVE-2026-68290

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the RDS TCP implementation where rds tcp exit net() frees the per-netns RDS TCP listen socket using rds tcp kill sock() before the per-netns sysctl table is unregistered. Because rds tcp skbuf handler() derives the network namespace from the socket, a concurrent sysctl write can lead to a slab-use-after-free, where the system dereferences a freed socket or socket buffer (sk).

Recommendations Update the Linux kernel to a version where the RDS TCP sysctl table is unregistered before calling rds tcp kill sock() to ensure the listen socket is released safely.