CVE-2010-3904: Linux Kernel RDS rds_page_copy_user Improper Input Validation Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows local privilege escalation, has public exploit code, and is listed in CISA KEV, but requires local access and affects older kernels.

What it is

The rds_page_copy_user function in net/rds/page.c in the Linux kernel before 2.6.36 fails to properly validate addresses obtained from user space. A local user can exploit this flaw through crafted sendmsg and recvmsg system calls to gain elevated privileges.

Impact

An attacker with local access can escalate privileges to root, gaining full control of the affected system.

Attack surface

The vulnerability is reached locally via the sendmsg and recvmsg system calls on RDS sockets. No authentication or user interaction is required beyond local access to the system.

Exploitation

CVE-2010-3904 is listed in CISA KEV with a due date of 2023-06-02, and public exploit code is referenced in Exploit-DB and Packet Storm. EPSS probability is 0.14583 (96.468th percentile), indicating active exploitation is likely.

What to do

• Apply the kernel update that fixes the rds_page_copy_user validation (Linux 2.6.36 or later vendor patches).
• If the RDS protocol is not required, disable the rds kernel module or blacklist it to prevent loading.
• For end-of-life products listed in CISA KEV, disconnect them from the network as required.
• Restrict local shell access to trusted users and monitor for privilege escalation attempts.
• Review vendor advisories (Red Hat, SUSE, Ubuntu, VMware) for specific patched versions and apply them.

Detection

• Monitor for unexpected use of RDS sockets (AF_RDS) via auditd or eBPF, especially sendmsg/recvmsg calls from non-privileged processes.
• Hunt for known exploit artifacts such as the vsecurity linux-rds-exploit.c or Exploit-DB 44677 payloads in process memory or file systems.
• Check kernel module load events for 'rds' on systems where it is not expected.
• Correlate local privilege escalation alerts (e.g., unexpected root shell spawns) with RDS socket activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.