Executive brief
The Linux kernel's Reliable Datagram Sockets (RDS) networking protocol implementation contains a race condition in its congestion map update logic. When a sender checks for port congestion or a process polls for network readiness, they may receive stale information and fail to wake up when congestion is relieved, causing network traffic to stall indefinitely until the next congestion update arrives or the sender is interrupted by a signal.
Technical details
The vulnerability is a memory ordering race condition (store-buffering pattern) in the net/rds/cong.c file, specifically in the rds_cong_map_updated() function. The function uses waitqueue_active() (a plain load with no memory barriers) to check if any processes are waiting on congestion updates, but the preceding atomic_inc() on rds_cong_generation carries no memory ordering guarantee. This allows a waiter (rds_cong_wait() or rds_poll()) to observe the congestion map as non-empty while the updater observes an empty wait queue, preventing the wake-up notification from being issued. The fix replaces waitqueue_active() with wq_has_sleeper(), which includes a full memory barrier before the check, ensuring proper ordering between the generation update and wake-up decision. This patch applies to the RDS congestion handling subsystem and affects any kernel version using RDS.
Affected products
- Linux Linux kernel all versions with RDS congestion handling
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-08-21: patched: Upstream commit d4f484661961636eb90d287050959e613795f73a by Allison Henderson
- 2026-09-14: other: Stable kernel patch applied