LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23419: net/rds: Fix circular locking dependency in rds_tcp_tune

In the Linux kernel, the following vulnerability has been resolved: net/rds: Fix circular locking dependency in rds_tcp_tune syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock: ====================================================== WARNING: possible circular locking dependency detected ====================================================== kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x6f0 but task is already holding lock: ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: rds_tcp_tune+0xd7/0x930 The issue occurs because sk_net_refcnt_upgrade() performs memory allocation (via get_net_track() -> ref_tracker_alloc()) while the socket lock is held, creating a circular dependency with fs_reclaim. Fix this by moving sk_net_refcnt_upgrade() outside the socket lock critical section. This is safe because the fields modified by the sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not accessed by any concurrent code path at this point. v2: - Corrected fixes tag - check patch line wrap nits - ai commentary nits

HighCVSS 7.5Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel locking flaw in the RDS-over-TCP networking path can create a circular dependency during memory allocation. The supplied CVSS assessment indicates a remote, unauthenticated attacker could potentially cause an availability failure, without exposing or modifying data. The issue has been corrected in Linux stable branches.

Executive priority

Treat as a high-priority availability issue on systems using RDS TCP, especially business-critical or network-exposed hosts. Patch through supported distribution channels after confirming branch-specific fixed packages. Broader emergency action is not supported by the supplied evidence because active exploitation has not been reported.

Technical view

rds_tcp_tune() called sk_net_refcnt_upgrade() while holding a socket lock. That function can allocate memory through get_net_track() and ref_tracker_alloc(), creating a circular dependency with fs_reclaim. The fix moves the reference-count upgrade outside the socket-lock critical section; the source states the modified fields are not concurrently accessed at that point.

Likely exposure

Exposure is limited to Linux systems using the affected kernel code and exercising the RDS TCP path. The source bundle records affected versions beginning at 5.18 and lists several later branch versions, but its version formatting is ambiguous. Confirm exact exposure against distribution advisories and the linked stable commits.

Exploitation context

The supplied record assigns CVSS 3.1 score 7.5 for network-reachable, low-complexity, unauthenticated availability impact. However, it is not in KEV, and the supplied sources provide no evidence of active exploitation or a public exploit. The defect was reported by syzbot as a possible circular locking dependency.

Researcher notes

The security consequence is availability-only in the supplied CVSS vector. The record attributes the problem to lock ordering around allocation under the socket lock and says moving sk_net_refcnt_upgrade() is concurrency-safe. Exact affected and fixed version boundaries cannot be confidently reconstructed from the bundle's abbreviated version entries; inspect the referenced stable commits and vendor backports.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable linked stable fix.
  • Check Linux distribution guidance for the corrected package version for each kernel branch.
  • Prioritize systems that enable or depend on RDS over TCP.
  • Use normal change controls because kernel remediation generally requires deployment and reboot.

Validation and detection

  • Inventory running kernel versions and identify systems using RDS TCP.
  • Compare distribution kernel changelogs with the linked stable fix commits.
  • Confirm the corrected kernel is running after maintenance, not merely installed.
  • Review kernel logs for related lock-dependency warnings or availability symptoms.
Prepared
Confidence
high
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23419 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-23419Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux3a58f13a881ed351198ffab4cf9953cf19d2ab3a, 3a58f13a881ed351198ffab4cf9953cf19d2ab3a, 3a58f13a881ed351198ffab4cf9953cf19d2ab3a, 3a58f13a881ed351198ffab4cf9953cf19d2ab3a, 3a58f13a881ed351198ffab4cf9953cf19d2ab3a, 2a6efabed754c9dcf27e6def71317b374f58a852, 5.17.7unaffected
LinuxLinux5.18, 0, 6.6.130, 6.12.77, 6.18.17, 6.19.7, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.