CVE-2010-3904: Linux Kernel Improper Input Validation Vulnerability

High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 15.7% chance of exploitation in the next 30 days.

The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 9.04 only; version 9.10 only; version 10.04 only; version 10.10 only
• Linux Linux Kernel: before 2.6.36 (fixed in 2.6.36)
• Opensuse Opensuse: version 11.2 only; version 11.3 only
• Red Hat Enterprise Linux: version 5.0 only; version 6.0 only
• Suse Linux Enterprise Desktop: version 11 only
• Suse Linux Enterprise Real Time Extension: version 11 only
• Suse Linux Enterprise Server: version 11 only
• VMware ESXi: version 3.5 only; version 4.0 only; version 4.1 only; version 5.0 only

Published 2010-12-06. Last modified 2026-06-16.