264 lines
13 KiB
JSON
264 lines
13 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-43230",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-05-01T14:12:55.994Z",
|
|
"datePublished": "2026-05-06T11:28:27.620Z",
|
|
"dateUpdated": "2026-08-05T12:26:43.969Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:26:43.969Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Clear reconnect pending bit\n\nWhen canceling the reconnect worker, care must be taken to reset the\nreconnect-pending bit. If the reconnect worker has not yet been\nscheduled before it is canceled, the reconnect-pending bit will stay\non forever."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - RDS over TCP exposes a kernel listener on TCP port 16385, and unauthenticated remote peers can drive the connection state changes that lead through rds_tcp_state_change(), rds_conn_path_drop(), and rds_conn_shutdown().\nAC:L - The attacker can repeatedly create/drop TCP connections or induce reconnect races; the stale pending-bit condition is reachable through normal connection-management timing and does not depend on an uncontrollable environment condition.\nPR:N - The network path accepts TCP peers before any RDS-level authentication or credential check, so a remote attacker needs no local account or privileges.\nUI:N - No victim user action is required once RDS TCP is enabled and reachable; the attacker only needs to interact with the exposed RDS TCP service.\nS:U - The impact remains within the kernel/RDS networking service security authority and does not cross a VM, sandbox, IOMMU, or similar boundary.\nC:N - The bug is a stale connection-management flag that suppresses reconnect scheduling; it does not expose memory contents or provide an information disclosure primitive.\nI:N - The issue does not corrupt memory or allow attacker-controlled modification of kernel or application data; it only affects reconnection behavior.\nA:H - Leaving RDS_RECONNECT_PENDING set can prevent future reconnect scheduling indefinitely, making the affected RDS path or peer connection unavailable until administrative recovery or another reset. In a critical RDS deployment this can fully deny communication to that peer, so high availability impact is appropriate."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/rds/connection.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be",
|
|
"lessThan": "3cf001aff71b1db1b4732a5381b012a114720664",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be",
|
|
"lessThan": "60b347333ec259ac7352f62cbbc365b04c065ff8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be",
|
|
"lessThan": "597c46a42930c963f448720aaf5001dd4ed98af4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be",
|
|
"lessThan": "391200c274e90c34071b909ba12e3390b81b767f",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be",
|
|
"lessThan": "ba2e3472022f44baddf000621fed150d7a599ea3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be",
|
|
"lessThan": "14eae5564053ac3973b9369dc674638f22f4765e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be",
|
|
"lessThan": "bcf034fa5f66b6a3e787f765a917934a2045cf7a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be",
|
|
"lessThan": "b89fc7c2523b2b0750d91840f4e52521270d70ed",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/rds/connection.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2.6.30",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "2.6.30",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.252",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.202",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.165",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.128",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.75",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.16",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.19.6",
|
|
"lessThanOrEqual": "6.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "5.10.252"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "5.15.202"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.1.165"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.6.128"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.12.75"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.18.16"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "6.19.6"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "2.6.30",
|
|
"versionEndExcluding": "7.0"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3cf001aff71b1db1b4732a5381b012a114720664"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/60b347333ec259ac7352f62cbbc365b04c065ff8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/597c46a42930c963f448720aaf5001dd4ed98af4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/391200c274e90c34071b909ba12e3390b81b767f"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ba2e3472022f44baddf000621fed150d7a599ea3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/14eae5564053ac3973b9369dc674638f22f4765e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/bcf034fa5f66b6a3e787f765a917934a2045cf7a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b89fc7c2523b2b0750d91840f4e52521270d70ed"
|
|
}
|
|
],
|
|
"title": "net/rds: Clear reconnect pending bit",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |