CVE-2026-98276 - Vulnerability Details

- net: lock the socket in sock_gettstamp()

Description

In the Linux kernel, the following vulnerability has been resolved:

net: lock the socket in sock_gettstamp()

sk->sk_flags must only be changed while holding the socket lock,
because sock_set_flag() and sock_reset_flag() use non atomic
operations (__set_bit() and __clear_bit()).

sock_gettstamp() is one of the last places where a bit of sk->sk_flags
is changed from a syscall without owning the socket lock, through
sock_enable_timestamp(sk, SOCK_TIMESTAMP).

sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags
without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,
sunrpc, wireguard) need a careful audit, this will be addressed in a
separate patch.

Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free
caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()
can cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,
because both threads perform a read-modify-write on the same word.

CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW)
-------------------------------- ----------------------------
read sk_flags = F read sk_flags = F
compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP)
store F | BIT(SOCK_RCU_FREE)
sk_add_node_rcu(sk, ...)
store F | BIT(SOCK_TIMESTAMP)

After the lost update, SOCK_RCU_FREE is clear while the socket is
visible to lockless UDP receive lookups. sk_destruct() then frees
the socket immediately instead of waiting for a RCU grace period,
while the receive path still holds a reference-less pointer to it:

BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410
Read of size 8 at addr ffff888008806610 by task exploit/207
CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1
ipv4_pktinfo_prepare+0x30/0x410
udp_queue_rcv_one_skb+0x51c/0x1180
udp_unicast_rcv_skb+0x109/0x350
ip_protocol_deliver_rcu+0x14b/0x310
ip_local_deliver_finish+0x29d/0x390
ip_local_deliver+0x24d/0x2a0

Only grab the socket lock when SOCK_TIMESTAMP has to be set,
to keep the common case lockless.

Published: 2026-10-06

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 18899e2e4023369a8f7739c2255a59a9748d8d17
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 88c804847dd87dc613b771b392ccecdb94725032
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3b12d3967e96f1b7b977d9fc352ae29a1b299a82
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1f73253add8365d0dad0a4f421acaa8c21d20cef
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d9f96bc2d822501f84d1caa6275a2c6b316ca2c4
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 899650bbf985b7bfd2a7b808357df9b16e6d6959
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9ed55f3dbef4f4adfe65eb03b0c35c53229a8490

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3-rc4`	unaffected	≤ *

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f
https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17
https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef
https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82
https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032
https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959
https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490
https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4

History

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sock_gettstamp() sk->sk_flags must only be changed while holding the socket lock, because sock_set_flag() and sock_reset_flag() use non atomic operations (__set_bit() and __clear_bit()). sock_gettstamp() is one of the last places where a bit of sk->sk_flags is changed from a syscall without owning the socket lock, through sock_enable_timestamp(sk, SOCK_TIMESTAMP). sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp, sunrpc, wireguard) need a careful audit, this will be addressed in a separate patch. Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind() can cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set, because both threads perform a read-modify-write on the same word. CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW) -------------------------------- ---------------------------- read sk_flags = F read sk_flags = F compute F \| BIT(SOCK_RCU_FREE) compute F \| BIT(SOCK_TIMESTAMP) store F \| BIT(SOCK_RCU_FREE) sk_add_node_rcu(sk, ...) store F \| BIT(SOCK_TIMESTAMP) After the lost update, SOCK_RCU_FREE is clear while the socket is visible to lockless UDP receive lookups. sk_destruct() then frees the socket immediately instead of waiting for a RCU grace period, while the receive path still holds a reference-less pointer to it: BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410 Read of size 8 at addr ffff888008806610 by task exploit/207 CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1 ipv4_pktinfo_prepare+0x30/0x410 udp_queue_rcv_one_skb+0x51c/0x1180 udp_unicast_rcv_skb+0x109/0x350 ip_protocol_deliver_rcu+0x14b/0x310 ip_local_deliver_finish+0x29d/0x390 ip_local_deliver+0x24d/0x2a0 Only grab the socket lock when SOCK_TIMESTAMP has to be set, to keep the common case lockless.
Title		net: lock the socket in sock_gettstamp()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17 https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82 https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032 https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959 https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490 https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:45:36.837Z

Updated: 2026-10-06T08:45:36.837Z

Reserved: 2026-09-25T10:25:14.334Z

Link: CVE-2026-98276

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:17.360

Modified: 2026-10-06T09:18:17.360

Link: CVE-2026-98276

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object