CVE-2026-68290

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rds: tcp: unregister sysctl before tearing down listen socket<br /> <br /> rds_tcp_exit_net() frees the per-netns RDS TCP listen socket via<br /> rds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since<br /> rds_tcp_skbuf_handler() derives the netns from<br /> rtn-&gt;rds_tcp_listen_sock-&gt;sk, a concurrent sysctl write can race with<br /> netns teardown and dereference the freed socket/sk.<br /> <br /> KASAN reports the race as:<br /> <br /> BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0<br /> rds_tcp_skbuf_handler net/rds/tcp.c:721<br /> proc_sys_call_handler fs/proc/proc_sysctl.c<br /> vfs_write fs/read_write.c<br /> __x64_sys_pwrite64 fs/read_write.c<br /> <br /> Fix this by unregistering the RDS TCP sysctl table before calling<br /> rds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl<br /> handlers from starting and waits for in-flight handlers to finish, so<br /> the listen socket can then be released safely. The fix was tested<br /> against the linked reproducer.