Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel…
Priority LOW 26CWE-362Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.
Summary
Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.
Why it matters now
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
Not affected: 2 products
- Red Hat Enterprise Linux 7
- Red Hat Enterprise MRG 2
Timeline
- 2026-10-02 Threatist record created from CVE-2015-7990
- 2026-10-03 Alias added: GHSA-ggf3-232m-5283
References
Advisory 28
- SUSE-SU-2015:2292
- SUSE-SU-2016:0337
- SUSE-SU-2015:2350
- SUSE-SU-2016:0434
- USN-2887-2
- USN-2886-1
- USN-2887-1
- SUSE-SU-2015:2194
- USN-2890-3
- openSUSE-SU-2015:2232
- SUSE-SU-2016:0380
- USN-2889-1
- SUSE-SU-2016:0354
- SUSE-SU-2016:0335
- SUSE-SU-2015:2339
- SUSE-SU-2015:2108
- USN-2889-2
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.3
- SUSE-SU-2016:0383
- SUSE-SU-2016:0386
- SUSE-SU-2016:2074
- USN-2890-2
- SUSE-SU-2016:0384
- DSA-3396
- USN-2890-1
- SUSE-SU-2016:0387
- SUSE-SU-2016:0381
- USN-2888-1
Other 7
- https://bugzilla.redhat.com/show_bug.cgi?id=1276437
- [linux-kernel] 20151016 [PATCH] RDS: fix race condition when sending a message on unbound socket.
- https://bugzilla.suse.com/show_bug.cgi?id=952384
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8c7188b23474cca017b3ef354c4a58456f68303a
- [oss-security] 20151027 Re: CVE-2015-6937 - Linux kernel - NULL pointer dereference in net/rds/connection.c
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://github.com/torvalds/linux/commit/8c7188b23474cca017b3ef354c4a58456f68303a
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
Sources
- CVE-2015-7990 · CVE Program
- CVE-2015-7990 · NVD
- FIRST EPSS
- GHSA-ggf3-232m-5283 · GitHub Advisory Database · CC BY 4.0
- CVE-2015-7990 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences