CVE-2026-23419 - Vulnerability Details

- net/rds: Fix circular locking dependency in rds_tcp_tune

Description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: Fix circular locking dependency in rds_tcp_tune

syzbot reported a circular locking dependency in rds_tcp_tune() where
sk_net_refcnt_upgrade() is called while holding the socket lock:

======================================================
WARNING: possible circular locking dependency detected
======================================================
kworker/u10:8/15040 is trying to acquire lock:
ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},
at: __kmalloc_cache_noprof+0x4b/0x6f0

but task is already holding lock:
ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},
at: rds_tcp_tune+0xd7/0x930

The issue occurs because sk_net_refcnt_upgrade() performs memory
allocation (via get_net_track() -> ref_tracker_alloc()) while the
socket lock is held, creating a circular dependency with fs_reclaim.

Fix this by moving sk_net_refcnt_upgrade() outside the socket lock
critical section. This is safe because the fields modified by the
sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not
accessed by any concurrent code path at this point.

v2:
- Corrected fixes tag
- check patch line wrap nits
- ai commentary nits

Published: 2026-04-03

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A circular locking dependency exists in the RDS TCP implementation of the Linux kernel. The function sk_net_refcnt_upgrade() allocates memory while holding the socket lock, creating a situation where the task can be stalled by another lock, leading to a deadlock. This weakness, classified as CWE-833, can result in a denial‑of‑service condition if the lock order is repeatedly violated.

Affected Systems

All Linux kernel distributions before the commit that introduced the lock fix are affected. The issue has been reported for both the generic Linux kernel and the Linux kernel for Linux-based systems. No specific version range is listed, so any kernel version that has not yet merged the patch is vulnerable.

Risk and Exploitability

The vulnerability carries a score of 5.5, indicating a moderate severity level. The estimated probability of exploitation is less than 1 percent, and it is not currently listed in the known exploited vulnerabilities catalog. The attack is inferred to require traffic that triggers rds_tcp_tune, so it is limited to scenarios where the RDS protocol is in use. While the risk is moderate, it primarily concerns availability rather than confidentiality or integrity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 8babb271403378ba6836f6c8599c5313d0e2355d
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 8519e6883a942e510f33a0e634e27bcc3a844a40
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 6ce948fa54599f369ff7fe8b793a6aae4b0762b2
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 026bbaeeab9e04534ee58882b6447300629b42f6
`3a58f13a881ed351198ffab4cf9953cf19d2ab3a`	affected	< 6a877ececd6daa002a9a0002cd0fbca6592a9244
`2a6efabed754c9dcf27e6def71317b374f58a852`	affected	—

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,8babb271403378ba6836f6c8599c5313d0e2355d)`	affected	code_commit	—
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,8519e6883a942e510f33a0e634e27bcc3a844a40)`	affected	code_commit	—
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,6ce948fa54599f369ff7fe8b793a6aae4b0762b2)`	affected	code_commit	—
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,026bbaeeab9e04534ee58882b6447300629b42f6)`	affected	code_commit	—
`[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,6a877ececd6daa002a9a0002cd0fbca6592a9244)`	affected	code_commit	—
`2a6efabed754c9dcf27e6def71317b374f58a852`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.18`	affected	semver	—
`[0,5.18)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.77,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.7,6.20.0)`	unaffected	semver	—
`[7.0-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the rds_tcp_tune lock fix
If updating is not immediately possible, disable the RDS protocol or related services to prevent the lock condition
Monitor system logs for lock contention or deadlock warnings and address any anomalies promptly

Generated by OpenCVE AI on April 7, 2026 at 09:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00018.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6
https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244
https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2
https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40
https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d
https://lore.kernel.org/linux-cve-announce/2026040303-CVE-2026-23419-6055@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23419
https://www.cve.org/CVERecord?id=CVE-2026-23419

History

Tue, 07 Apr 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-833
References		https://lore.kernel.org/linux-cve-announce/2026040303-CVE-2026-23419-6055@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23419 https://www.cve.org/CVERecord?id=CVE-2026-23419
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Fri, 03 Apr 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/rds: Fix circular locking dependency in rds_tcp_tune syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock: ====================================================== WARNING: possible circular locking dependency detected ====================================================== kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x6f0 but task is already holding lock: ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: rds_tcp_tune+0xd7/0x930 The issue occurs because sk_net_refcnt_upgrade() performs memory allocation (via get_net_track() -> ref_tracker_alloc()) while the socket lock is held, creating a circular dependency with fs_reclaim. Fix this by moving sk_net_refcnt_upgrade() outside the socket lock critical section. This is safe because the fields modified by the sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not accessed by any concurrent code path at this point. v2: - Corrected fixes tag - check patch line wrap nits - ai commentary nits
Title		net/rds: Fix circular locking dependency in rds_tcp_tune
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6 https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244 https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2 https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40 https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T13:24:23.958Z

Updated: 2026-04-03T13:24:23.958Z

Reserved: 2026-01-13T15:37:46.014Z

Link: CVE-2026-23419

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-03T14:16:27.843

Modified: 2026-04-03T16:10:23.730

Link: CVE-2026-23419

Redhat

Severity : Moderate

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-23419 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-08T19:54:17Z

Weaknesses

CWE-833

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object