Executive brief
A vulnerability was identified in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. The issue involves a locking conflict that can occur during network socket tuning, potentially leading to a system deadlock or crash. This could impact the availability of services relying on RDS for high-performance data transfer.
Technical details
A circular locking dependency was discovered in net/rds/tcp.c within the rds_tcp_tune() function. The vulnerability is triggered when sk_net_refcnt_upgrade() is called while holding the socket lock. Because sk_net_refcnt_upgrade() performs memory allocation (via ref_tracker_alloc()) using GFP_KERNEL, it can trigger fs_reclaim, which may attempt to acquire the same socket lock, resulting in a deadlock. The fix involves moving the reference count upgrade outside of the socket lock critical section. This issue was originally reported by syzbot.
Affected products
- Linux Linux Kernel 5.17.7 to 5.18, 6.1, 6.6, 6.12, 6.13
Timeline
- 2026-02-27: disclosed: Initial patch submitted by Allison Henderson
- 2026-03-12: patched: Patch committed to stable trees
- 2026-04-03: advisory: CVE-2026-23419 published
References
- https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6
- https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244
- https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2
- https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40
- https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d