266 lines
14 KiB
JSON
266 lines
14 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-53077",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-06-09T07:44:35.383Z",
|
|
"datePublished": "2026-06-24T16:30:17.972Z",
|
|
"dateUpdated": "2026-08-05T12:33:10.122Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:33:10.122Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Restrict use of RDS/IB to the initial network namespace\n\nPrevent using RDS/IB in network namespaces other than the initial one.\nThe existing RDS/IB code will not work properly in non-initial network\nnamespaces."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - Reachability is through local syscalls: unshare a user/network namespace, create an AF_RDS socket, select RDS/IB with setsockopt, then bind/send and tear down the namespace. A remote peer alone cannot create the stale non-init namespace RDS/IB connection.\nAC:L - The attacker controls the namespace lifetime and socket operations needed to leave an RDS/IB connection with a stale net pointer, and syzbot reproduced the UAF. No hard-to-win race or victim state outside attacker control is required.\nPR:L - AF_RDS socket creation and SO_RDS_TRANSPORT do not require real init-namespace root, and the issue is reachable by an unprivileged local user via user namespaces. This is not an unauthenticated remote path, so low local privileges are required.\nUI:N - No victim action is needed after the attacker runs the local namespace and socket sequence. The later RDMA/RDS workqueue access occurs asynchronously in kernel context.\nS:U - The vulnerability corrupts/accesses kernel resources within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-authority boundary break.\nC:H - The bug is a slab use-after-free read of a freed net_namespace from RDS/IB asynchronous connection handling. Under the required kernel scoring guidance, UAFs are scored as high confidentiality impact because freed object reuse can expose kernel memory.\nI:H - Although the observed report is a UAF read, use-after-free bugs can generally be shaped through heap reuse into stronger memory corruption primitives. Per the required guidance and uncertainty rule, this warrants high integrity impact.\nA:H - Syzbot reports a KASAN slab-use-after-free in rds_conn_path_drop, and the same stale pointer access can trigger kernel oops/panic or destabilize RDS/RDMA workqueues. Kernel crash availability impact is high."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/rds/af_rds.c",
|
|
"net/rds/ib.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
|
|
"lessThan": "3e7f14cd5a51533404e1ae4809caab46073fb5c7",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
|
|
"lessThan": "3174fc703d081d2ca538b22fba734e3ad5b52322",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
|
|
"lessThan": "c244b79adffad89a5173cf8bfaa06a6b40bbd09b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
|
|
"lessThan": "07035306bf722f4676a1aee35cbeb3732c76194e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
|
|
"lessThan": "fb407343c0c16e94584707b2dfdd350a5f81b000",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
|
|
"lessThan": "a7494479757d60d2413bfaa087f8431a26eea032",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
|
|
"lessThan": "b6a54f5e9ce9b97ae641855378d71c5154a085c0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d5a8ac28a7ff2f250d1bedbb6008dd2f6f6f1638",
|
|
"lessThan": "ebf71dd4aff46e8e421d455db3e231ba43d2fa8a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/rds/af_rds.c",
|
|
"net/rds/ib.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "4.3",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "4.3",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.258",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.209",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.175",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.141",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.91",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.33",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0.10",
|
|
"lessThanOrEqual": "7.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "5.10.258"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "5.15.209"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.1.175"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.6.141"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.12.91"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "6.18.33"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "7.0.10"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "4.3",
|
|
"versionEndExcluding": "7.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3e7f14cd5a51533404e1ae4809caab46073fb5c7"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3174fc703d081d2ca538b22fba734e3ad5b52322"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c244b79adffad89a5173cf8bfaa06a6b40bbd09b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/07035306bf722f4676a1aee35cbeb3732c76194e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/fb407343c0c16e94584707b2dfdd350a5f81b000"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a7494479757d60d2413bfaa087f8431a26eea032"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b6a54f5e9ce9b97ae641855378d71c5154a085c0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ebf71dd4aff46e8e421d455db3e231ba43d2fa8a"
|
|
}
|
|
],
|
|
"title": "net/rds: Restrict use of RDS/IB to the initial network namespace",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |