CVE-2026-98276 - Vulnerability Details

- net: lock the socket in sock_gettstamp()

Description

In the Linux kernel, the following vulnerability has been resolved:

net: lock the socket in sock_gettstamp()

sk->sk_flags must only be changed while holding the socket lock,
because sock_set_flag() and sock_reset_flag() use non atomic
operations (__set_bit() and __clear_bit()).

sock_gettstamp() is one of the last places where a bit of sk->sk_flags
is changed from a syscall without owning the socket lock, through
sock_enable_timestamp(sk, SOCK_TIMESTAMP).

sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags
without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,
sunrpc, wireguard) need a careful audit, this will be addressed in a
separate patch.

Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free
caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()
can cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,
because both threads perform a read-modify-write on the same word.

CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW)
-------------------------------- ----------------------------
read sk_flags = F read sk_flags = F
compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP)
store F | BIT(SOCK_RCU_FREE)
sk_add_node_rcu(sk, ...)
store F | BIT(SOCK_TIMESTAMP)

After the lost update, SOCK_RCU_FREE is clear while the socket is
visible to lockless UDP receive lookups. sk_destruct() then frees
the socket immediately instead of waiting for a RCU grace period,
while the receive path still holds a reference-less pointer to it:

BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410
Read of size 8 at addr ffff888008806610 by task exploit/207
CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1
ipv4_pktinfo_prepare+0x30/0x410
udp_queue_rcv_one_skb+0x51c/0x1180
udp_unicast_rcv_skb+0x109/0x350
ip_protocol_deliver_rcu+0x14b/0x310
ip_local_deliver_finish+0x29d/0x390
ip_local_deliver+0x24d/0x2a0

Only grab the socket lock when SOCK_TIMESTAMP has to be set,
to keep the common case lockless.

Published: 2026-10-06

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the socket flag field sk->sk_flags is altered without holding the socket lock in sock_gettstamp(). This race condition (CWE‑413) allows a concurrent SIOCGSTAMPNS_NEW ioctl and a bind() call to perform read‑modify‑write on the same word, potentially clearing the SOCK_RCU_FREE bit prematurely. The kernel then frees the socket immediately while the UDP receive path still has a reference‑less pointer, resulting in a slab use‑after‑free fault that can lead to kernel memory corruption.

Affected Systems

All Linux kernel builds expose UDP sockets and call sock_gettstamp() without the added socket lock. Any distribution running an unpatched kernel version is within scope, including standard releases and custom derivatives that have not yet incorporated the patch.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of <1% shows a very low but nonzero exploitation probability. The vulnerability is not listed in CISA KEV. The attack vector inferred from the description requires an adversary to race an SIOCGSTAMPNS_NEW ioctl with a bind() on a UDP socket, causing a lost update of the socket flags and a subsequent use‑after‑free that can corrupt kernel memory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 18899e2e4023369a8f7739c2255a59a9748d8d17
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 88c804847dd87dc613b771b392ccecdb94725032
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3b12d3967e96f1b7b977d9fc352ae29a1b299a82
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1f73253add8365d0dad0a4f421acaa8c21d20cef
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d9f96bc2d822501f84d1caa6275a2c6b316ca2c4
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 899650bbf985b7bfd2a7b808357df9b16e6d6959
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9ed55f3dbef4f4adfe65eb03b0c35c53229a8490

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,18899e2e4023369a8f7739c2255a59a9748d8d17)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,88c804847dd87dc613b771b392ccecdb94725032)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3b12d3967e96f1b7b977d9fc352ae29a1b299a82)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1f73253add8365d0dad0a4f421acaa8c21d20cef)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d9f96bc2d822501f84d1caa6275a2c6b316ca2c4)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,899650bbf985b7bfd2a7b808357df9b16e6d6959)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9ed55f3dbef4f4adfe65eb03b0c35c53229a8490)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patch adding socket locking in sock_gettstamp()
If a vendor release is not yet available, apply the relevant upstream patch manually or wait for distribution maintenance
Audits kernel modules such as nbd, iscsi_tcp, nvme-tcp, sunrpc, and wireguard to ensure they obtain the socket lock before modifying sk_flags
Enable kernel memory corruption detection tools such as KASAN and monitor system logs for use‑after‑free faults

Generated by OpenCVE AI on October 11, 2026 at 05:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98276.mbox
https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f
https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17
https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef
https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82
https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032
https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959
https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490
https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4
https://nvd.nist.gov/vuln/detail/CVE-2026-98276
https://www.cve.org/CVERecord?id=CVE-2026-98276

History

Sun, 11 Oct 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Sun, 11 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-413
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98276.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98276 https://www.cve.org/CVERecord?id=CVE-2026-98276
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 07 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Wed, 07 Oct 2026 10:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Wed, 07 Oct 2026 07:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 06 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Tue, 06 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Tue, 06 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sock_gettstamp() sk->sk_flags must only be changed while holding the socket lock, because sock_set_flag() and sock_reset_flag() use non atomic operations (__set_bit() and __clear_bit()). sock_gettstamp() is one of the last places where a bit of sk->sk_flags is changed from a syscall without owning the socket lock, through sock_enable_timestamp(sk, SOCK_TIMESTAMP). sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp, sunrpc, wireguard) need a careful audit, this will be addressed in a separate patch. Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind() can cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set, because both threads perform a read-modify-write on the same word. CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW) -------------------------------- ---------------------------- read sk_flags = F read sk_flags = F compute F \| BIT(SOCK_RCU_FREE) compute F \| BIT(SOCK_TIMESTAMP) store F \| BIT(SOCK_RCU_FREE) sk_add_node_rcu(sk, ...) store F \| BIT(SOCK_TIMESTAMP) After the lost update, SOCK_RCU_FREE is clear while the socket is visible to lockless UDP receive lookups. sk_destruct() then frees the socket immediately instead of waiting for a RCU grace period, while the receive path still holds a reference-less pointer to it: BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410 Read of size 8 at addr ffff888008806610 by task exploit/207 CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1 ipv4_pktinfo_prepare+0x30/0x410 udp_queue_rcv_one_skb+0x51c/0x1180 udp_unicast_rcv_skb+0x109/0x350 ip_protocol_deliver_rcu+0x14b/0x310 ip_local_deliver_finish+0x29d/0x390 ip_local_deliver+0x24d/0x2a0 Only grab the socket lock when SOCK_TIMESTAMP has to be set, to keep the common case lockless.
Title		net: lock the socket in sock_gettstamp()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17 https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82 https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032 https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959 https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490 https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:45:36.837Z

Updated: 2026-10-19T09:16:47.879Z

Reserved: 2026-09-25T10:25:14.334Z

Link: CVE-2026-98276

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:17.360

Modified: 2026-10-19T10:18:28.973

Link: CVE-2026-98276

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98276 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-11T05:00:12Z

Weaknesses

CWE-413
Improper Resource Locking

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object