CVE-2026-68335

CVE-2026-68335 is a use-after-free in the Linux kernel's RDS protocol stack with a 12-year exposure window (Linux 3.8, 2013) and dual dereference primitives that compound risk in ways the CVSS 7.8 doesn't capture. The race condition in rds_recv_incoming() triggers during namespace teardown, and KASAN confirmed the c_lcong read (offset 88, size 200) is reachable — this is a controlled information leak enabling heap grooming for subsequent exploits. The second dereference site, c_trans->inc_free, is a function pointer call that could become a call-through-freed primitive, but the available evidence confirms only the information leak, not the code execution path. Treat this as one confirmed primitive plus one theoretically exploitable path, not a guaranteed escalation chain. The fix adding net_eq() validation in rds_recv_incoming() is correct at the right layer — rejecting delivery rather than making teardown safe. However, this introduces its own temporal gap: net_eq() validates at delivery time, but the actual dereference happens later in rds_inc_put(). If namespace teardown races against message processing rather than receipt, the check may not protect the UAF site. Verify whether other code paths into rds_clear_recv_queue() bypass this check entirely — that's where the next gap will likely surface. On the namespace requirement: the CLONE_NEWUSER + CLONE_NEWNET prerequisite sounds like meaningful isolation, but container breakout literature and production container deployments routinely grant these capabilities. The blast radius of successful exploitation is host-level, not container-level — once you can trigger this race, you've already bypassed the container boundary that mattered. The practical exploitation barrier is lower than the CVE metadata suggests. The deeper concern: this is the third or fourth surgical fix of this exact pattern — global rhashtables keyed on (addr, port) without namespace context. The pressure producing these bugs isn't exhausted by one patch. Audit other global lookup structures in the kernel networking stack for the same blind spot.

Reviewed through automated stages and approved by a human before publication.