A use‑after‑free flaw exists in the Linux kernel RDS subsystem: when rds_find_bound() looks up a destination socket it ignores the network namespace, enabling a sender in one namespace to deliver a packet to a socket in another. If the sending process exits, the kernel frees the connection object, but the receiver still holds a reference to it. Dereferencing the stale pointer in rds_clear_recv_queue() can read freed data or call a freed function pointer, potentially leading to arbitrary code execution. The flaw is a use‑after‑free, identified as CWE‑825.

All Linux kernel releases starting with version 3.8 carry the flaw until the repository fix that adds a network‑namespace check to rds_recv_incoming is applied. The affected code resides in the RDS layer, and the issue can be triggered from unprivileged user namespaces that are allowed to create new network namespaces (CLONE_NEWUSER + CLONE_NEWNET).

The kernel patch corrects the problem by rejecting cross‑namespace RDS messages, eliminating the use‑after‑free race. Because the vulnerability can be reached from user namespaces and the failure mode can lead to arbitrary code execution or denial of service, the risk is high. The KEV status for this flaw is not listed, and the EPSS score of < 1% indicates a low exploitation probability, while the CVSS score of 7.8 denotes a high severity; no current exploitation data is published, but the potential impact remains significant if an attacker can trigger the race.