CVE-2026-52995: Linux Kernel RDS Information Disclosure via Uninitialized Memory

Technical summary

The vulnerability exists in rds_for_each_conn_info() and rds_walk_conn_path_info() kernel functions, which pass caller-allocated stack buffers to per-connection visitor callbacks. The IB (InfiniBand) connection info visitors—rds_ib_conn_info_visitor() and rds6_ib_conn_info_visitor()—only conditionally initialize portions of their output structs when connections are in specific states. When an RDS connection is not in RDS_CONN_UP state, several fields (max_send_wr, max_recv_wr, max_send_sge, rdma_mr_max, rdma_mr_size, cache_allocs) and alignment padding in rds_info_rdma_connection and rds6_info_rdma_connection structures remain uninitialized. The kernel then copies the entire buffer—including uninitialized portions—to user space via rds_info_copy() and memcpy_to_user(), leaking kernel stack content. The structures are not marked __attribute__((packed)), creating real alignment holes that remain populated with whatever preceded the function call.

Business impact

This is an information disclosure vulnerability with localized impact. Unprivileged local users can extract kernel memory containing pointers and potentially sensitive data through a simple getsockopt() call on RDS sockets. While the CVSS score reflects this as a denial-of-service-capable issue (due to vector component A:H), the primary risk is information leakage that could support kernel ASLR bypass or facilitate more sophisticated attacks. Organizations with multi-tenant systems, containers, or shared Linux hosts face elevated risk; single-user workstations and servers without local user access are less affected.

Affected systems

Linux kernel versions are affected when compiled with AF_RDS and RDMA support enabled. The vulnerability requires local access and an RDMA-capable network interface (or soft-RoCE emulation on any NIC). Systems must have RDS transport set to IB (InfiniBand) and allow unprivileged user access to RDS sockets. Verification against kernel source (net/rds/info.c and related files) is necessary to determine exact vulnerable versions; the patch addresses the root cause in the visitor framework.

Exploitability

Exploitability is straightforward for local attackers. An unprivileged user can open an AF_RDS socket, set SO_RDS_TRANSPORT=IB, bind to a local RDMA-capable interface, initiate a connection, and call getsockopt(SOL_RDS, RDS_INFO_IB_CONNECTIONS) to retrieve the uninitialized buffer. No special privileges, race conditions, or crash-inducing steps are required. The attack is reliable and repeatable. However, exploitation requires RDS to be enabled in the kernel and RDMA hardware (or rxe soft-RoCE) to be present and accessible.

Remediation

The fix zeroes the per-item buffer in both rds_for_each_conn_info() and rds_walk_conn_path_info() before invoking visitor callbacks. This ensures that any uninitialized fields or padding holes are cleared before the buffer reaches user space, eliminating the information leak while maintaining functional compatibility with visitors that fully populate their output. The patch is minimal, non-invasive, and applies consistently across IPv4/IPv6 IB visitors and future code.

Patch guidance

Apply the kernel patch that adds memset(0) initialization in the rds_for_each_conn_info() and rds_walk_conn_path_info() functions prior to visitor invocation. Verify the patch against the official Linux kernel repository (net tree) with subject prefix net/rds: and the message describing zeroing of per-item info buffers. Distributions will backport this fix to their stable kernel branches; check your vendor's advisory for specific version numbers and update timelines.

Detection guidance

Monitor kernel logs for RDS socket creation and getsockopt() calls from unprivileged processes, particularly those using SOL_RDS option level. Network-level detection is difficult since the attack uses local system calls. In containerized/multi-tenant environments, restrict RDS module loading and disable AF_RDS if not required. Use kernel configuration audits to identify systems with CONFIG_RDS and CONFIG_RDS_RDMA enabled. Intrusion detection can flag repeated getsockopt(RDS_INFO_*) patterns that may indicate probing for kernel addresses.

Why prioritize this

Although CVSS 5.5 is moderate, the vulnerability merits prompt attention in environments with untrusted local users. Information disclosure vulnerabilities are valuable for attackers building exploit chains; leaked kernel pointers defeat ASLR and enable more powerful kernel exploits. Environments sharing Linux hosts across users, or running containers with overlapping security domains, should treat this as high priority. Single-user systems and air-gapped servers can deprioritize if RDS is unused.

Risk score, explained

CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields a score of 5.5 (MEDIUM). Attack Vector is Local (AV:L) and Access Complexity is Low (AC:L), reflecting straightforward exploitation. Privileges Required (PR:L) indicates unprivileged user access suffices. No User Interaction (UI:N) and Unchanged Scope (S:U) keep the score moderate. The C:N (no confidentiality impact) and I:N (no integrity impact) are debatable—the leak does expose kernel memory—but the official vector reflects the kernel's perspective: the RDS subsystem itself is not compromised in confidentiality or integrity, only denies availability of uninitialized memory. In practice, information disclosure raises real-world risk beyond the numeric score.

Frequently asked questions