Linux net/rds: allocation under the socket lock creates a reclaim deadlock path

Impact

rds_tcp_tune() called sk_net_refcnt_upgrade() while holding the socket lock, and that path allocates memory via ref_tracker_alloc(), producing the circular dependency with fs_reclaim that syzbot reported. Under memory pressure this can deadlock the task and the socket, hanging RDS traffic. RDS is the socket family HPC and Oracle-style clusters use over TCP and RDMA, so where it is in use the exposure is a stuck interconnect path on a node that must then be reset; on hosts that never load the rds modules the code is unreachable. The record documents a lockdep report, not an observed hang in production.

Who can reach it

Local: requires the rds and rds_tcp modules loaded and the ability to open an RDS socket, plus memory pressure driving reclaim. No remote or cross-tenant path is described in the record.

What to do

Take the stable kernel update that moves sk_net_refcnt_upgrade() outside the socket-lock critical section (five stable commits are linked in the record; no fixed release number is given there). That is a node drain and reboot. If RDS is not used on the fleet, blacklisting the rds/rds_tcp modules removes the exposure without a reboot cycle.

References

Related entries

• Linux i915 GPU kernel driver (submission backend setup): i915 dereferences the submission backend before checkingCVE-2026-31540 · Linux i915 GPU kernel driver (submission backend setup)Medium
• Linux kernel KVM SEV: userspace can trivially trigger a kernel WARN via an oversized encrypt-region ioctlCVE-2026-31590 · Linux kernel KVM SEV (sev_pin_memory WARN on KVM_MEMORY_ENCRYPT_REG_REGION)Medium
• Linux KVM/SEV: unlocked sev_guest() check lets a local user crash the host kernelCVE-2026-31592 · Linux kernel KVM SEV (sev_mem_enc_register_region)Medium
• Linux kernel: AMD Zen1 divider leaks partial results across SMT threads until the FPDSS bit is setCVE-2026-31628 · Linux kernel x86/CPU (AMD Zen1 FPDSS divider chicken bit)Medium
• Linux kernel AF_ALG: receive-side scatterlist extraction ignored the receive buffer budgetCVE-2026-31677 · Linux kernel crypto AF_ALG (af_alg_get_rsgl receive buffer accounting)Medium
• Linux kernel BPF: sleepable programs could attach to kprobe_multi and sleep in atomic contextCVE-2026-43010 · Linux kernel BPF (bpf_kprobe_multi_link_attach sleepable program check)Medium