{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  rds: drop incoming messages that cross network namespace boundaries  rds_find_bound() looks up the destination socket using a global rhashtable keyed solely on (addr, port, scope_id).  Network namespaces are not part of the key, so a sender in netns A can deliver an incoming message (inc) to a socket that lives in a different netns B.  When this happens, inc-\u003ei_conn points to an rds_connection whose c_net is netns A, but the receiving rs lives in netns B.  Once the child process that created netns A exits, cleanup_net() calls rds_loop_exit_net() -\u003e rds_loop_kill_conns() -\u003e rds_conn_destroy(), freeing that connection.  If the survivor socket in netns B still holds the inc, any subsequent dereference of inc-\u003ei_conn is a use-after-free.  There are two dangerous sites in rds_clear_recv_queue():   1. inc-\u003ei_conn-\u003ec_lcong (offset 88 of freed rds_connection, size 200)      read via rds_recv_rcvbuf_delta() -- confirmed by KASAN.   2. inc-\u003ei_conn-\u003ec_trans-\u003einc_free(inc) (function pointer at offset 80)      called via rds_inc_put() when the inc refcount reaches zero -- same      race window, potential call-through-freed-object primitive.  The bug is reachable from unprivileged user namespaces (CLONE_NEWUSER + CLONE_NEWNET), available since Linux 3.8.  Fix this by rejecting the delivery in rds_recv_incoming() when the socket returned by rds_find_bound() belongs to a different network namespace than the connection that carried the message.  Use the existing rds_conn_net() / sock_net() helpers and net_eq() for the comparison.",
  "id": "DEBIAN-CVE-2026-68335",
  "modified": "2026-09-14T16:47:48.736118456Z",
  "published": "2026-08-10T13:20:23.863Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68335"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-68335"
  ]
}