Linux kernel RDS connection info (uninitialised per-item buffer copied to userspace): The connection-info walkers hand

CVSS 5.5CVE-2026-52995Kernel, userspace & hypervisorcurated

Impact

The connection-info walkers hand a per-item stack buffer to a visitor and then copy the full declared item length back to userspace regardless of how much the visitor filled in. When a connection is not in the UP state the IB visitors write only a subset - several u32 fields and an alignment hole are left holding whatever was on the kernel stack - and all of it is copied out. Any unprivileged process that can query RDS info harvests kernel stack bytes, which is the standard first step for defeating KASLR before using a corruption bug.

Who can reach it

Local, unprivileged. Query RDS connection info while at least one connection is not in the UP state - trivially arranged by the querying tenant.

What to do

Kernel update zeroing the item buffer before each visitor call. Blacklisting rds removes the surface immediately.

References

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0797b2e6901827694aa9c34c4c72118c8c97fba1 https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-52995.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.