Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before aef4a9ae95d1bc4f7897065011e6261026719aeb; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before dad1fe7db6c6519138430ac8f5e589c18f83bfc9; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a7e761ba55efaa9c49e0afdd304bb78167af3429; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before cd644e6dc72eec8d9d988717ea1c54f8668ded69; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9ed654e340f4c73bc6f0af2fbc90ac293e645ce0; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before fe89b2f05b854847784f91127319172945c1fadd; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7178e2a8027423b2af17ab95df73a749a5b72e5b; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 858d2a4f67ff69e645a43487ef7ea7f28f06deae |
| Linux / Linux | affected 2.6.12; unaffected 0 before 2.6.12; unaffected 5.10.270 through 5.10.*; unaffected 5.15.221 through 5.15.*; unaffected 6.1.188 through 6.1.*; unaffected 6.6.157 through 6.6.*; unaffected 6.12.110 through 6.12.*; unaffected 6.18.16 through 6.18.*; unaffected 6.19.6 through 6.19.*; unaffected 7.0 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/aef4a9ae95d1bc4f7897065011e6261026719aeb
- https://git.kernel.org/stable/c/dad1fe7db6c6519138430ac8f5e589c18f83bfc9
- https://git.kernel.org/stable/c/a7e761ba55efaa9c49e0afdd304bb78167af3429
- https://git.kernel.org/stable/c/cd644e6dc72eec8d9d988717ea1c54f8668ded69
- https://git.kernel.org/stable/c/9ed654e340f4c73bc6f0af2fbc90ac293e645ce0
- https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd
- https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b
- https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae
ADP enrichment
A flaw was found in the Linux kernel. A race condition exists in the TCP (Transmission Control Protocol) IPv6 (Internet Protocol version 6) socket handling, specifically within the tcp_v6_syn_recv_sock() function. This occurs because a child socket becomes visible in the TCP hash table before its IPv6-specific information is fully initialized. A remote attacker could potentially exploit this timing window, leading to an unstable system state or unexpected behavior, which may result in a denial of service (DoS).
- https://access.redhat.com/security/cve/CVE-2026-43198
- https://bugzilla.redhat.com/show_bug.cgi?id=2467228
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json
- https://access.redhat.com/errata/RHSA-2026:36216
- https://access.redhat.com/errata/RHSA-2026:41236
- https://access.redhat.com/errata/RHSA-2026:33215
- https://access.redhat.com/errata/RHSA-2026:30129
- https://access.redhat.com/errata/RHSA-2026:36073
- https://access.redhat.com/errata/RHSA-2026:34443
- https://access.redhat.com/errata/RHSA-2026:34094
- https://access.redhat.com/errata/RHSA-2026:33285
- https://access.redhat.com/errata/RHSA-2026:36349
- https://access.redhat.com/errata/RHSA-2026:35896
- https://access.redhat.com/errata/RHSA-2026:35894
- https://access.redhat.com/errata/RHSA-2026:35863
- https://access.redhat.com/errata/RHSA-2026:36348
- https://access.redhat.com/errata/RHSA-2026:35904
No English description supplied.
No references supplied.