AZL-104421 CVE-2026-97954 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

Linux Distros Unpatched Vulnerability : CVE-2026-97954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial...

PT-2026-98618

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rds message map pages function where PAGE SIZE bytes are assigned to every scatterlist entry, even when total len ends in a partial page. On systems where PAGE SIZ...

PT-2026-98733

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Reliable Datagram Sockets RDS implementation where the rds tcp reset callbacks function fails to properly synchronize the transmit path. The function attempts to...

PT-2026-98735

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A store-buffering pattern exists in the release in xmit function. The function uses clear bit unlock to clear RDS IN XMIT, which orders the critical section before the bit clear but fail...

DEBIAN-CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

EUVD-2026-86074

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fixed an issue where a use-after-free occurred in net in reqsktimerhandler. syzkaller reported a warning regarding the netns tracker 0, followed by KASAN, SPLAT 1, and another ref tracker warning 1. syzkaller was unable...

SUSE CVE-2026-68290

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering the per-netns sysctl table. Since rdstcpskbufhandler derives the netns...

CVE-2026-74563

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS TCP module. The rdstcpladdrcheck function fails to hold the Read-Copy-Update RCU lock across an IPv6 address check. This allows a race condition where a network device can be freed while still being referenced, leading to a...

AZL-96222 CVE-2026-74563 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74563 rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74563 rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-68290

A flaw was found in the Linux kernel's Reliable Datagram Sockets RDS TCP implementation. A race condition can occur during network namespace teardown, where a concurrent system control sysctl write operation attempts to access a socket that has already been freed. This use-after-free vulnerabilit...

Linux Distros Unpatched Vulnerability : CVE-2026-68290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering th...

CVE-2026-68290

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering the per-netns sysctl table. Since rdstcpskbufhandler derives the netns...

UBUNTU-CVE-2026-68290

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering the per-netns sysctl table. Since rdstcpskbufhandler derives the netns...

CVE-2026-68290 rds: tcp: unregister sysctl before tearing down listen socket

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering the per-netns sysctl table. Since rdstcpskbufhandler derives the netns...