Linux kernel RDS (Reliable Datagram Sockets) net/rds/page.c - rds_page_copy_user: Straight local-to-root. RDS - the

Impact

Straight local-to-root. RDS - the datagram protocol built for InfiniBand cluster interconnects and still autoloaded by socket(PF_RDS,...) on stock distro kernels - copied to and from user-supplied addresses without validating them, so an unprivileged user writes to arbitrary kernel memory and takes the node. The operator-relevant twist is that nobody has to be using RDS: any tenant process that opens an RDS socket triggers the module autoload, so the attack surface exists on every node whose kernel shipped the module, RDMA fabric or not. CISA lists it as a known-exploited vulnerability; reliable public exploits have existed since 2010.

Who can reach it

Local, entirely unprivileged. One socket() call from inside any tenant container or VM that has not masked module autoloading.

What to do

Kernel upgrade past 2.6.36 or a vendor backport (commit 799c10559d60f159ab2232203f222f18fa3c4a5f, de-pessimize rds_page_copy_user). Any kernel this old is well past support and the real remediation is a fleet-wide OS upgrade, which is a rolling drain-and-reboot. The zero-downtime mitigation that operators should apply regardless of patch state is to blacklist the module and stub the alias - install rds /bin/true in modprobe.d - which removes the surface immediately and costs nothing unless you are actually running RDS.

References