CVE-2026-97476

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rds: filter RDS_INFO_* getsockopt by caller&amp;#39;s netns<br /> <br /> The RDS_INFO_* family of getsockopt(2) options reads several<br /> file-scope global lists that are not per-netns:<br /> <br /> rds_sock_info / rds6_sock_info,<br /> rds_sock_inc_info / rds6_sock_inc_info -&gt; rds_sock_list<br /> rds_tcp_tc_info / rds6_tcp_tc_info -&gt; rds_tcp_tc_list<br /> rds_conn_info / rds6_conn_info,<br /> rds_conn_message_info_cmn (for the *_SEND_MESSAGES and<br /> *_RETRANS_MESSAGES variants),<br /> rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS)<br /> -&gt; rds_conn_hash[]<br /> <br /> The handlers do not filter by the caller&amp;#39;s network namespace.<br /> rds_info_getsockopt() has no netns or capable() check, and<br /> rds_create() has no capable() check, so AF_RDS is reachable from<br /> an unprivileged user namespace. As a result, an unprivileged<br /> caller in a fresh user_ns plus netns can read the bound address<br /> and sock inode of every RDS socket on the host, the peer address<br /> of incoming messages on every RDS socket on the host, the peer<br /> address and TCP sequence numbers of every rds-tcp connection on<br /> the host, and the peer address and RDS sequence numbers of every<br /> RDS connection on the host.<br /> <br /> The rds-tcp transport is reachable from a non-initial netns (see<br /> rds_set_transport()), so a one-shot init_net gate at<br /> rds_info_getsockopt() would deny legitimate per-netns visibility<br /> to rds-tcp callers. Instead, filter at each handler by comparing<br /> the netns of the caller&amp;#39;s socket to the netns of the list entry,<br /> or to rds_conn_net(conn) for connection paths. Only copy entries<br /> whose netns matches the caller. Counters (RDS_INFO_COUNTERS) are<br /> aggregate statistics and remain global.<br /> <br /> Reproducer (KASAN VM, rds and rds_tcp loaded): an AF_RDS socket<br /> binds 127.0.0.1:4242 in init_net as root. A child process enters<br /> a fresh user_ns plus netns and opens AF_RDS there, then calls<br /> getsockopt(SOL_RDS, RDS_INFO_SOCKETS). Before this change, the<br /> child sees the init_net socket. After this change, the child<br /> sees zero entries.<br /> <br /> Drop the rds_sock_count, rds_tcp_tc_count, and rds6_tcp_tc_count<br /> globals. v2 used them for the size precheck and lens-&gt;nr; v3<br /> replaced the precheck with a per-ns count from a first pass over<br /> the list, so the globals have no remaining readers. The matching<br /> increments and decrements in rds_create()/rds_destroy_sock() and<br /> rds_tcp_set_callbacks()/rds_tcp_restore_callbacks() go away with<br /> them. Reported by the kernel test robot under clang W=1.