---
id: CVE-2025-21635
title: 'rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

  As mentioned in a previous commit of this series, using the 'net'
  structure via 'current' is not recomm…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c6a58ffed53612be86b758df1cdb0b0f4305e9cb <
    6f353c2230c199f343406c08482940ec5d8ba89c
  - >-
    Linux >= c6a58ffed53612be86b758df1cdb0b0f4305e9cb <
    33b3e09a489a31b30342b77cc55290f025d95c7e
  - >-
    Linux >= c6a58ffed53612be86b758df1cdb0b0f4305e9cb <
    de8d6de0ee27be4b2b1e5b06f04aeacbabbba492
  - >-
    Linux >= c6a58ffed53612be86b758df1cdb0b0f4305e9cb <
    7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c
  - Linux 4.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T19:54:16.928023Z'
published: '2025-01-19'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:20:39.557Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21635'
references:
  - url: 'https://git.kernel.org/stable/c/6f353c2230c199f343406c08482940ec5d8ba89c'
  - url: 'https://git.kernel.org/stable/c/33b3e09a489a31b30342b77cc55290f025d95c7e'
  - url: 'https://git.kernel.org/stable/c/de8d6de0ee27be4b2b1e5b06f04aeacbabbba492'
  - url: 'https://git.kernel.org/stable/c/7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c'
tags:
  - cve.org
epss: 0.00254
epssPercentile: 0.16922
ingestedAt: '2026-10-21T12:48:53.721Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

As mentioned in a previous commit of this series, using the 'net'
structure via 'current' is not recommended for different reasons:

- Inconsistency: getting info from the reader's/writer's netns vs only
  from the opener's netns.

- current->nsproxy can be NULL in some cases, resulting in an 'Oops'
  (null-ptr-deref), e.g. when the current task is exiting, as spotted by
  syzbot [1] using acct(2).

The per-netns structure can be obtained from the table->data using
container_of(), then the 'net' one can be retrieved from the listen
socket (if available).

## Affected

- `Linux >= c6a58ffed53612be86b758df1cdb0b0f4305e9cb < 6f353c2230c199f343406c08482940ec5d8ba89c`
- `Linux >= c6a58ffed53612be86b758df1cdb0b0f4305e9cb < 33b3e09a489a31b30342b77cc55290f025d95c7e`
- `Linux >= c6a58ffed53612be86b758df1cdb0b0f4305e9cb < de8d6de0ee27be4b2b1e5b06f04aeacbabbba492`
- `Linux >= c6a58ffed53612be86b758df1cdb0b0f4305e9cb < 7f5611cbc4871c7fb1ad36c2e5a9edad63dca95c`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.