CVE-2026-23419 addresses a circular locking dependency in the Linux kernel's net/rds subsystem, specifically in the rds_tcp_tune() function. The problem arises because sk_net_refcnt_upgrade() is called while holding the socket lock, and this function performs memory allocation that can trigger a circular dependency with the fs_reclaim lock. This can lead to deadlocks or system hangs. The fix involves moving the call to sk_net_refcnt_upgrade() outside the critical section protected by the socket lock, eliminating the circular dependency. This vulnerability affects Linux kernel versions prior to 6.8.0-1064.72 and related variants. The issue was reported by syzbot and has been resolved in updated kernel releases.

The vulnerability can cause a circular locking dependency leading to deadlocks or system instability, resulting in denial of service (availability impact). There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild, reducing immediate risk but patching is recommended to prevent potential system hangs.

A patch is available and has been released to fix this vulnerability. Users should update their Linux kernel to version 6.8.0-1064.72 or later (or the corresponding fixed versions listed) to remediate the issue. After updating, a system reboot is required to apply the kernel changes. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. No additional mitigation actions are indicated by the vendor advisory.