Junglewise Threat Intelligence

CVE-2026-52995: Linux Kernel information leak in net/rds connection info

CVE-2026-52995 · Severity: info · CVSS 4.4 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security vulnerability in the Linux kernel's Reliable Datagram Sockets (RDS) component could allow a local user to view sensitive information from the system's memory. This occurs because the system fails to clear temporary storage before sending network connection details to a user. An attacker could exploit this to obtain internal system addresses or other data that could be used to bypass security protections.

Technical details

A kernel stack information leak exists in net/rds/connection.c. The functions rds_for_each_conn_info() and rds_walk_conn_path_info() allocate a buffer on the stack and pass it to visitor functions (like rds_ib_conn_info_visitor) to be populated. If the visitor function only partially fills the structure—which occurs when an RDS connection is not in the RDS_CONN_UP state—uninitialized stack memory, including kernel pointers and alignment holes, is copied back to userspace via rds_info_copy(). A local unprivileged user can trigger this by opening an AF_RDS socket, setting the transport to InfiniBand (IB), and calling getsockopt with RDS_INFO_IB_CONNECTIONS. The fix involves explicitly zeroing the buffer with memset() before it is passed to any visitor function.

Affected products

  • Linux Linux Kernel All versions prior to fixed releases in 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y, 6.8.y, and 6.9.y

Timeline

  • 2026-04-18: other: Patch submitted by Michael Bommarito
  • 2026-06-01: patched: Commits merged into stable branches
  • 2026-06-24: disclosed: CVE published

References

Related threats