Linux kernel (net/rds): Bind() on an RDS socket with a scoped IPv6 address looks up the interface under RCU, drops the

Impact

Bind() on an RDS socket with a scoped IPv6 address looks up the interface under RCU, drops the RCU lock, and then passes the bare net_device pointer into the address check. A concurrent interface delete frees the device in that window, so the bind path reads freed memory - KASAN confirms the slab-use-after-free, and the published reproducer is literally named 'exploit'.

Who can reach it

Local and unprivileged: bind an AF_RDS socket to a scoped IPv6 address while an interface is being removed. A tenant with its own network namespace can delete its own veth to supply the race partner, and socket(AF_RDS, ...) autoloads rds/rds_tcp through the net-pf-21 alias with no capability check. No RDMA hardware or device node needed.

What to do

Boot a kernel carrying the fix commits (keeps the RCU read-side lock held across ipv6_chk_addr). Interim: blacklist the rds module family (install rds /bin/false) or deny socket family 21 in tenant seccomp profiles.

References