net/rds: Fix circular locking dependency in rds_tcp_tune
Summary
| CVE | CVE-2026-23419 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-04-03 14:16:27 UTC |
| Updated | 2026-04-03 16:10:23 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: net/rds: Fix circular locking dependency in rds_tcp_tune syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock: ====================================================== WARNING: possible circular locking dependency detected ====================================================== kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x6f0 but task is already holding lock: ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: rds_tcp_tune+0xd7/0x930 The issue occurs because sk_net_refcnt_upgrade() performs memory allocation (via get_net_track() -> ref_tracker_alloc()) while the socket lock is held, creating a circular dependency with fs_reclaim. Fix this by moving sk_net_refcnt_upgrade() outside the socket lock critical section. This is safe because the fields modified by the sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not accessed by any concurrent code path at this point. v2: - Corrected fixes tag - check patch line wrap nits - ai commentary nits |
Risk And Classification
EPSS: 0.000180000 probability, percentile 0.046140000 (date 2026-04-07)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 3a58f13a881ed351198ffab4cf9953cf19d2ab3a 8babb271403378ba6836f6c8599c5313d0e2355d git | Not specified |
| CNA | Linux | Linux | affected 3a58f13a881ed351198ffab4cf9953cf19d2ab3a 8519e6883a942e510f33a0e634e27bcc3a844a40 git | Not specified |
| CNA | Linux | Linux | affected 3a58f13a881ed351198ffab4cf9953cf19d2ab3a 6ce948fa54599f369ff7fe8b793a6aae4b0762b2 git | Not specified |
| CNA | Linux | Linux | affected 3a58f13a881ed351198ffab4cf9953cf19d2ab3a 026bbaeeab9e04534ee58882b6447300629b42f6 git | Not specified |
| CNA | Linux | Linux | affected 3a58f13a881ed351198ffab4cf9953cf19d2ab3a 6a877ececd6daa002a9a0002cd0fbca6592a9244 git | Not specified |
| CNA | Linux | Linux | affected 2a6efabed754c9dcf27e6def71317b374f58a852 git | Not specified |
| CNA | Linux | Linux | affected 5.18 | Not specified |
| CNA | Linux | Linux | unaffected 5.18 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.130 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.77 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.17 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.19.7 6.19.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0-rc3 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.