CVE-2026-23419

net/rds: Fix circular locking dependency in rds_tcp_tune

Published Apr 3, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: Fix circular locking dependency in rds_tcp_tune

syzbot reported a circular locking dependency in rds_tcp_tune() where
sk_net_refcnt_upgrade() is called while holding the socket lock:

======================================================
WARNING: possible circular locking dependency detected
======================================================
kworker/u10:8/15040 is trying to acquire lock:
ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},
at: __kmalloc_cache_noprof+0x4b/0x6f0

but task is already holding lock:
ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},
at: rds_tcp_tune+0xd7/0x930

The issue occurs because sk_net_refcnt_upgrade() performs memory
allocation (via get_net_track() -> ref_tracker_alloc()) while the
socket lock is held, creating a circular dependency with fs_reclaim.

Fix this by moving sk_net_refcnt_upgrade() outside the socket lock
critical section. This is safe because the fields modified by the
sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not
accessed by any concurrent code path at this point.

v2:
- Corrected fixes tag
- check patch line wrap nits
- ai commentary nits

Analysis

Technical impact

A circular locking dependency exists in the RDS TCP implementation of the Linux kernel; the function sk_net_refcnt_upgrade() performs memory allocation while holding the socket lock, creating a situation where the task can be stalled by another lock, leading to deadlock. This weakness aligns with CWE‑833 and also demonstrates characteristics of CWE‑667, a race condition that can cause inconsistent state or deadlock. The flaw can lead to a denial‑of‑service if the lock order is repeatedly violated.

Affected Systems

All Linux kernel distributions before the commit that introduced the lock fix are affected. The issue has been reported for both the generic Linux kernel and the Linux kernel for Linux-based systems. No specific version range is listed, so any kernel version that has not yet merged the patch is vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.5, indicating a high severity level. The estimated probability of exploitation is less than 1 percent, and it is not currently listed in CISA KEV. The attack vector is inferred to require traffic that triggers rds_tcp_tune, limiting exposure to environments where the RDS protocol is active. The flaw primarily threatens availability, potentially leading to blocking of RDS connections or a kernel-level deadlock that can disable network services.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< ce5be6703afd2ac2ff7dabd397137d71d22d4bc3
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 8babb271403378ba6836f6c8599c5313d0e2355d
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 8519e6883a942e510f33a0e634e27bcc3a844a40
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 6ce948fa54599f369ff7fe8b793a6aae4b0762b2
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 026bbaeeab9e04534ee58882b6447300629b42f6
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 6a877ececd6daa002a9a0002cd0fbca6592a9244
`2a6efabed754c9dcf27e6def71317b374f58a852`	affected	—
`5.17.7`	affected	< 5.18

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`6.1.191`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.18:-::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,8babb271403378ba6836f6c8599c5313d0e2355d)`	affected	code_commit	—
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,8519e6883a942e510f33a0e634e27bcc3a844a40)`	affected	code_commit	—
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,6ce948fa54599f369ff7fe8b793a6aae4b0762b2)`	affected	code_commit	—
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,026bbaeeab9e04534ee58882b6447300629b42f6)`	affected	code_commit	—
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,6a877ececd6daa002a9a0002cd0fbca6592a9244)`	affected	code_commit	—
`2a6efabed754c9dcf27e6def71317b374f58a852`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.18`	affected	semver	—
`[0,5.18)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.77,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.7,6.20.0)`	unaffected	semver	—
`[7.0-rc3,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the rds_tcp_tune lock fix
If updating is not immediately possible, disable the RDS protocol or related services to prevent the lock condition
Monitor system logs for lock contention or deadlock warnings and address any anomalies promptly

Generated by OpenCVE AI on April 28, 2026 at 08:57 UTC.

Tracking

Advisories

Source	ID	Title
Debian DSA	DSA-6238-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.193% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6
https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244
https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2
https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40
https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d
https://git.kernel.org/stable/c/ce5be6703afd2ac2ff7dabd397137d71d22d4bc3
https://lore.kernel.org/linux-cve-announce/2026040303-CVE-2026-23419-6055@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23419
https://www.cve.org/CVERecord?id=CVE-2026-23419

History

Oct 30, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/ce5be6703afd2ac2ff7dabd397137d71d22d4bc3

Apr 27, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Apr 24, 2026 3:30 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-667
CPEs		cpe:2.3:o:linux:linux_kernel:5.18:-:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

Apr 7, 2026 8:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362

Apr 4, 2026 1:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026040303-CVE-2026-23419-6055@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23419 https://www.cve.org/CVERecord?id=CVE-2026-23419
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Apr 3, 2026 9:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Apr 3, 2026 2:00 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/rds: Fix circular locking dependency in rds_tcp_tune syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock: ====================================================== WARNING: possible circular locking dependency detected ====================================================== kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x6f0 but task is already holding lock: ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: rds_tcp_tune+0xd7/0x930 The issue occurs because sk_net_refcnt_upgrade() performs memory allocation (via get_net_track() -> ref_tracker_alloc()) while the socket lock is held, creating a circular dependency with fs_reclaim. Fix this by moving sk_net_refcnt_upgrade() outside the socket lock critical section. This is safe because the fields modified by the sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not accessed by any concurrent code path at this point. v2: - Corrected fixes tag - check patch line wrap nits - ai commentary nits
Title		net/rds: Fix circular locking dependency in rds_tcp_tune
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6 https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244 https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2 https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40 https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d