Linux kernel (net/rds): Network-namespace teardown frees the per-netns RDS/TCP listen socket before unregistering the

Impact

Network-namespace teardown frees the per-netns RDS/TCP listen socket before unregistering the matching sysctl table, and the sysctl handler derives its namespace from that socket. A write to the sysctl racing namespace exit dereferences the freed socket - KASAN confirms a slab-use-after-free, giving a tenant that owns a namespace a host-kernel corruption primitive.

Who can reach it

Local, and reachable by a tenant rather than only by host root wherever unprivileged user namespaces are enabled: a container that creates its own user+network namespace holds CAP_NET_ADMIN inside it, so it can write /proc/sys/net/rds/tcp/* and simultaneously tear the namespace down. On hosts with unprivileged userns disabled this needs real root in a netns. The rds_tcp module autoloads from an unprivileged socket(AF_RDS, ...).

What to do

Update to 6.12.101 or later on that branch, or any kernel carrying the fix commits (unregisters the sysctl table before killing the listen socket). Interim: blacklist rds/rds_tcp, or set kernel.unprivileged_userns_clone=0 / user.max_user_namespaces=0 for tenant workloads that do not need namespaces.

References