CVE-2026-68335

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.8 and later (affected versions not specified)

Description A use-after-free issue exists in the Reliable Datagram Sockets (RDS) implementation. The rds find bound() function uses a global rhastable keyed by address, port, and scope ID, but does not include network namespaces in the key. This allows a sender in one network namespace to deliver a message to a socket in a different network namespace. If the process that created the sender's namespace exits, the connection is freed. If the receiving socket still holds the message, subsequent dereferences of inc->i conn lead to a use-after-free. This can be triggered via unprivileged user namespaces using CLONE NEWUSER and CLONE NEWNET. The issue manifests in rds clear recv queue() through rds recv rcvbuf delta() and rds inc put(), where a function pointer may be called through a freed object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.