CVE-2026-97476

A moderate information disclosure flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. The RDS_INFO_* family of getsockopt(2) options reads file-scope global socket and connection lists (rds_sock_list, rds_tcp_tc_list, and rds_conn_hash[]) without filtering entries by the caller's network namespace, and rds_info_getsockopt() contains no network namespace or capability check. Because an AF_RDS socket can be created from an unprivileged user namespace, an unprivileged local attacker who enters a fresh user namespace and network namespace can issue these getsockopt calls and read information about RDS sockets and connections belonging to other namespaces on the host, including bound and peer addresses, socket inode numbers, and TCP and RDS sequence numbers. This violates network namespace isolation, but the exposure is limited to RDS socket and connection metadata: the flaw provides no write or memory corruption primitive and cannot alter kernel state or cause a denial of service, which is why Red Hat assesses the impact of this flaw as moderate even though a CVSS:3.1 base score of 7.0 is recorded for it. In the current product scope, all supported Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams are not affected because the vulnerable code is not present in their kernels; the only affected record is the out-of-support RHEL 6 Extended Lifecycle Support stream, which is resolved as out of support scope.