CVE-2026-97476

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. An unprivileged local attacker can exploit this vulnerability to cause information disclosure across isolated network environments. Because socket inspection handlers do not filter connection and socket lists by the caller's network namespace, an attacker can issue queries to expose network addresses, inode numbers, and protocol sequence numbers from other namespaces on the host.

A moderate information disclosure flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. The RDS_INFO_* family of getsockopt(2) options reads file-scope global socket and connection lists (rds_sock_list, rds_tcp_tc_list, and rds_conn_hash[]) without filtering entries by the caller's network namespace, and rds_info_getsockopt() contains no network namespace or capability check. Because an AF_RDS socket can be created from an unprivileged user namespace, an unprivileged local attacker who enters a fresh user namespace and network namespace can issue these getsockopt calls and read information about RDS sockets and connections belonging to other namespaces on the host, including bound and peer addresses, socket inode numbers, and TCP and RDS sequence numbers. This violates network namespace isolation, but the exposure is limited to RDS socket and connection metadata: the flaw provides no write or memory corruption primitive and cannot alter kernel state or cause a denial of service, which is why Red Hat assesses the impact of this flaw as moderate even though a CVSS:3.1 base score of 7.0 is recorded for it. In the current product scope, all supported Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams are not affected because the vulnerable code is not present in their kernels; the only affected record is the out-of-support RHEL 6 Extended Lifecycle Support stream, which is resolved as out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.