{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43230", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.994Z", "datePublished": "2026-05-06T11:28:27.620Z", "dateUpdated": "2026-08-05T12:26:43.969Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:43.969Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Clear reconnect pending bit\n\nWhen canceling the reconnect worker, care must be taken to reset the\nreconnect-pending bit. If the reconnect worker has not yet been\nscheduled before it is canceled, the reconnect-pending bit will stay\non forever." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - RDS over TCP exposes a kernel listener on TCP port 16385, and unauthenticated remote peers can drive the connection state changes that lead through rds_tcp_state_change(), rds_conn_path_drop(), and rds_conn_shutdown().\nAC:L - The attacker can repeatedly create/drop TCP connections or induce reconnect races; the stale pending-bit condition is reachable through normal connection-management timing and does not depend on an uncontrollable environment condition.\nPR:N - The network path accepts TCP peers before any RDS-level authentication or credential check, so a remote attacker needs no local account or privileges.\nUI:N - No victim user action is required once RDS TCP is enabled and reachable; the attacker only needs to interact with the exposed RDS TCP service.\nS:U - The impact remains within the kernel/RDS networking service security authority and does not cross a VM, sandbox, IOMMU, or similar boundary.\nC:N - The bug is a stale connection-management flag that suppresses reconnect scheduling; it does not expose memory contents or provide an information disclosure primitive.\nI:N - The issue does not corrupt memory or allow attacker-controlled modification of kernel or application data; it only affects reconnection behavior.\nA:H - Leaving RDS_RECONNECT_PENDING set can prevent future reconnect scheduling indefinitely, making the affected RDS path or peer connection unavailable until administrative recovery or another reset. In a critical RDS deployment this can fully deny communication to that peer, so high availability impact is appropriate." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/rds/connection.c" ], "versions": [ { "version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be", "lessThan": "3cf001aff71b1db1b4732a5381b012a114720664", "status": "affected", "versionType": "git" }, { "version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be", "lessThan": "60b347333ec259ac7352f62cbbc365b04c065ff8", "status": "affected", "versionType": "git" }, { "version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be", "lessThan": "597c46a42930c963f448720aaf5001dd4ed98af4", "status": "affected", "versionType": "git" }, { "version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be", "lessThan": "391200c274e90c34071b909ba12e3390b81b767f", "status": "affected", "versionType": "git" }, { "version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be", "lessThan": "ba2e3472022f44baddf000621fed150d7a599ea3", "status": "affected", "versionType": "git" }, { "version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be", "lessThan": "14eae5564053ac3973b9369dc674638f22f4765e", "status": "affected", "versionType": "git" }, { "version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be", "lessThan": "bcf034fa5f66b6a3e787f765a917934a2045cf7a", "status": "affected", "versionType": "git" }, { "version": "00e0f34c616603ba6500f41943cbf89eb4a8a5be", "lessThan": "b89fc7c2523b2b0750d91840f4e52521270d70ed", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/rds/connection.c" ], "versions": [ { "version": "2.6.30", "status": "affected" }, { "version": "0", "lessThan": "2.6.30", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.252", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.202", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.165", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.128", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.10.252" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "5.15.202" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.1.165" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.6.128" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.12.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.18.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "6.19.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3cf001aff71b1db1b4732a5381b012a114720664" }, { "url": "https://git.kernel.org/stable/c/60b347333ec259ac7352f62cbbc365b04c065ff8" }, { "url": "https://git.kernel.org/stable/c/597c46a42930c963f448720aaf5001dd4ed98af4" }, { "url": "https://git.kernel.org/stable/c/391200c274e90c34071b909ba12e3390b81b767f" }, { "url": "https://git.kernel.org/stable/c/ba2e3472022f44baddf000621fed150d7a599ea3" }, { "url": "https://git.kernel.org/stable/c/14eae5564053ac3973b9369dc674638f22f4765e" }, { "url": "https://git.kernel.org/stable/c/bcf034fa5f66b6a3e787f765a917934a2045cf7a" }, { "url": "https://git.kernel.org/stable/c/b89fc7c2523b2b0750d91840f4e52521270d70ed" } ], "title": "net/rds: Clear reconnect pending bit", "x_generator": { "engine": "bippy-1.2.0" } } } }