CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune
In the Linux kernel, the following vulnerability has been resolved:
net/rds: Fix circular locking dependency in rds_tcp_tune
syzbot reported a circular locking dependency in rds_tcp_tune() where
sk_net_refcnt_upgrade() is called while holding the socket lock:
======================================================
WARNING: possible circular locking dependency detected
======================================================
kworker/u10:8/15040 is trying to acquire lock:
ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},
at: __kmalloc_cache_noprof+0x4b/0x6f0
but task is already holding lock:
ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},
at: rds_tcp_tune+0xd7/0x930
The issue occurs because sk_net_refcnt_upgrade() performs memory
allocation (via get_net_track() -> ref_tracker_alloc()) while the
socket lock is held, creating a circular dependency with fs_reclaim.
Fix this by moving sk_net_refcnt_upgrade() outside the socket lock
critical section. This is safe because the fields modified by the
sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not
accessed by any concurrent code path at this point.
v2:
- Corrected fixes tag
- check patch line wrap nits
- ai commentary nits
Security readout for executives and security teams
Plain-English summary
A Linux kernel locking flaw in the RDS-over-TCP networking path can create a circular dependency during memory allocation. The supplied CVSS assessment indicates a remote, unauthenticated attacker could potentially cause an availability failure, without exposing or modifying data. The issue has been corrected in Linux stable branches.
Executive priority
Treat as a high-priority availability issue on systems using RDS TCP, especially business-critical or network-exposed hosts. Patch through supported distribution channels after confirming branch-specific fixed packages. Broader emergency action is not supported by the supplied evidence because active exploitation has not been reported.
Technical view
rds_tcp_tune() called sk_net_refcnt_upgrade() while holding a socket lock. That function can allocate memory through get_net_track() and ref_tracker_alloc(), creating a circular dependency with fs_reclaim. The fix moves the reference-count upgrade outside the socket-lock critical section; the source states the modified fields are not concurrently accessed at that point.
Likely exposure
Exposure is limited to Linux systems using the affected kernel code and exercising the RDS TCP path. The source bundle records affected versions beginning at 5.18 and lists several later branch versions, but its version formatting is ambiguous. Confirm exact exposure against distribution advisories and the linked stable commits.
Exploitation context
The supplied record assigns CVSS 3.1 score 7.5 for network-reachable, low-complexity, unauthenticated availability impact. However, it is not in KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. The defect was reported by syzbot as a possible circular locking dependency.
Researcher notes
The security consequence is availability-only in the supplied CVSS vector. The record attributes the problem to lock ordering around allocation under the socket lock and says moving sk_net_refcnt_upgrade() is concurrency-safe. Exact affected and fixed version boundaries cannot be confidently reconstructed from the bundle's abbreviated version entries; inspect the referenced stable commits and vendor backports.
Mitigation direction
Update to a vendor-supported kernel containing the applicable linked stable fix.
Check Linux distribution guidance for the corrected package version for each kernel branch.
Prioritize systems that enable or depend on RDS over TCP.
Use normal change controls because kernel remediation generally requires deployment and reboot.
Validation and detection
Inventory running kernel versions and identify systems using RDS TCP.
Compare distribution kernel changelogs with the linked stable fix commits.
Confirm the corrected kernel is running after maintenance, not merely installed.
Review kernel logs for related lock-dependency warnings or availability symptoms.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-23419 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
6Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.