CVE-2026-52995 Linux CVE debrief

Who should care

System administrators and users of Linux-based systems should be aware of this vulnerability, especially those with unprivileged user access. This vulnerability could potentially be used to gather sensitive information about the system's memory layout.

Technical summary

The vulnerability exists in the RDS subsystem of the Linux kernel. Specifically, the functions rds_for_each_conn_info() and rds_walk_conn_path_info() hand a caller-allocated on-stack u64 buffer to a per-connection visitor and then copy the full item_len bytes back to user space via rds_info_copy(). If the visitor does not fully populate the buffer, it may contain stack garbage, including kernel pointers and other sensitive information. This can be exploited by a local unprivileged user who can open an AF_RDS socket, set SO_RDS_TRANSPORT=IB, bind to a local address on an RDMA-capable netdev, sendto() to any peer on the same subnet, and then call getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) to receive the 68-byte item containing stack garbage.

Defensive priority

High

Recommended defensive actions

• Apply the official patch or update to a fixed kernel version
• Restrict access to RDS functionality for unprivileged users
• Monitor system logs for suspicious RDS activity
• Consider implementing additional security controls, such as SELinux or AppArmor policies, to limit RDS usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by zeroing the per-item buffer in both rds_for_each_conn_info() and rds_walk_conn_path_info() before invoking the visitor. This fix covers the IPv4/IPv6 IB visitors and hardens all current and future visitors against the same class of bug.

Official resources