Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-43198

tcp: fix potential race in tcp_v6_syn_recv_sock()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < aef4a9ae95d1bc4f7897065011e6261026719aebaffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < dad1fe7db6c6519138430ac8f5e589c18f83bfc9affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < a7e761ba55efaa9c49e0afdd304bb78167af3429affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < cd644e6dc72eec8d9d988717ea1c54f8668ded69affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9ed654e340f4c73bc6f0af2fbc90ac293e645ce0affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < fe89b2f05b854847784f91127319172945c1faddaffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7178e2a8027423b2af17ab95df73a749a5b72e5baffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 858d2a4f67ff69e645a43487ef7ea7f28f06deaeaffected

Linux Linux

Default version status: affected

  • 2.6.12affected
  • 0 to < 2.6.12unaffected
  • 5.10.270 to ≤ 5.10.*unaffected
  • 5.15.221 to ≤ 5.15.*unaffected
  • 6.1.188 to ≤ 6.1.*unaffected
  • 6.6.157 to ≤ 6.6.*unaffected
  • 6.12.110 to ≤ 6.12.*unaffected
  • 6.18.16 to ≤ 6.18.*unaffected
  • 6.19.6 to ≤ 6.19.*unaffected
  • 7.0 to ≤ *unaffected

References