Linux kernel rds_tcp_tune circular locking dependency causes deadlock via sk_net_refcnt_upgrade

Status: UPDATED  |  Advisory ID: CVE-2026-23419

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net/rds: Fix circular locking dependency in rds_tcp_tune

syzbot reported a circular locking dependency in rds_tcp_tune() where

sk_net_refcnt_upgrade() is called while holding the socket lock:

======================================================

WARNING: possible circular locking dependency detected

======================================================

kworker/u10:8/15040 is trying to acquire lock:

ffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},

at: __kmalloc_cache_noprof+0x4b/0x6f0

but task is already holding lock:

ffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},

at: rds_tcp_tune+0xd7/0x930

The issue occurs because sk_net_refcnt_upgrade() performs memory

allocation (via get_net_track() -> ref_tracker_alloc()) while the

socket lock is held, creating a circular dependency with fs_reclaim.

Fix this by moving sk_net_refcnt_upgrade() outside the socket lock

critical section. This is safe because the fields modified by the

sk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not

accessed by any concurrent code path at this point.

v2:

- Corrected fixes tag

- check patch line wrap nits

- ai commentary nits (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References