Vulnerability in linux (CVE-2026-43198, CVSS 9.8)

Summary

vulnerability in linux (CVE-2026-43198). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix potential race in tcp_v6_syn_recv_sock()

Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()
is done too late.

After tcp_v4_syn_recv_sock(), the child socket is already visible
from TCP ehash table and other cpus might use it.

Since newinet->pinet6 is still pointing to the listener ipv6_pinfo
bad things can happen as syzbot found.

Move the problematic code in tcp_v6_mapped_child_init()
and call this new helper from tcp_v4_syn_recv_sock() before
the ehash insertion.

This allows the removal of one tcp_sync_mss(), since
tcp_v4_syn_recv_sock() will call it with the correct
context.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical vulnerability was discovered in the Linux kernel, potentially allowing attackers to gain unauthorized network access. Specifically, an error in TCP functions could lead to system compromise. It is crucial to update systems promptly as the issue has now been fixed.

The vulnerability in the Linux kernel's tcp_v6_syn_recv_sock() function involved a race condition that could allow attackers to manipulate sockets from the TCP ehash table. The issue was fixed by moving the problematic code to tcp_v6_mapped_child_init() and calling it before ehash insertion in tcp_v4_syn_recv_sock(). This eliminated an unnecessary tcp_sync_mss() call.

❓ What is the problem

A potential race condition in Linux kernel's tcp_v6_syn_recv_sock().

📍 Affected scope

tcp_v6_syn_recv_sock() function in the Linux kernel.

🔥 Severity

Critical, can lead to unauthorized access and manipulation of network communications.

🔧 How to fix

The issue was fixed by moving code to tcp_v6_mapped_child_init() and calling it from tcp_v4_syn_recv_sock() before ehash insertion.

🛡️ Workaround

No workaround was specifically mentioned in the available information.

🔍 Detection

No specific detection method was described in the available information.

Related past incidents Similar incidents extracted from past CVEs

CVE-2019-14835

Kernel vulnerability allowing remote attackers to cause a denial of service via a race condition in the SCTP implementation.

CVE-2020-10713

A flaw in the GRUB2 bootloader allowing bypass of UEFI secure boot, mostly seen as a race condition.

CVE-2018-5391

Also known as FragmentSmack, this vulnerability is due to a flaw in the Linux Kernel, allowing session impact via crafted packets, linked to a race condition.

If this happens at your company Expected impact per business scenario

📌 ECサイトの場合

攻撃者がサーバーのネットワーク通信を操作し、不正アクセスや情報漏洩が発生する可能性があります。

📌 社内システムの場合

内部ネットワーク上の通信が脆弱になるため、外部からの攻撃に対して無防備になる可能性があります。

📌 クラウドサービス提供の場合

クラウドインスタンスが不正に操作され、顧客データの漏洩やサービスの停止が発生する可能性があります。

Recommended action

迅速にサーバーやネットワーク機器のLinuxカーネルをアップデートし、セキュリティパッチを適用すること。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
Audit SBOM/dependencies for affected components.
```
依存マニフェストで影響コンポーネントを特定する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-43198 linux-lts
Debian DEBIAN-CVE-2026-43198 linux
Ubuntu UBUNTU-CVE-2026-43198 linux

Vulnerability in linux (CVE-2026-43198)