CVE-2026-98384

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98384", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.345Z", "datePublished": "2026-10-09T07:34:23.097Z", "dateUpdated": "2026-10-19T09:18:35.149Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:18:35.149Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()\n\nsk_protocol lives in struct sock, not in struct sock_common. A timewait\nor request sock handed to bpf_sock_destroy() by the tcp iterator is\nneither, so reading sk->sk_protocol runs past the object:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0\nRead of size 2 at addr ffff8881047d11b4 by task test_progs/428\n\nTainted: [W]=WARN\nCall Trace:\n <TASK>\n dump_stack_lvl+0x91/0xf0\n print_report+0xd1/0x630\n kasan_report+0xf3/0x130\n __asan_report_load2_noabort+0x14/0x30\n bpf_sock_destroy+0xc7/0xe0\n bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7\n bpf_iter_run_prog+0x538/0xde0\n bpf_iter_tcp_seq_show+0x26b/0x4b0\n bpf_seq_read+0x424/0x1210\n vfs_read+0x197/0xe40\n ksys_read+0x119/0x240\n __x64_sys_read+0x72/0xc0\n x64_sys_call+0x647/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOnly check sk_protocol on full socks. tcp_abort() already knows how to\ndeal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it\nnever matched the code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/filter.c"], "versions": [{"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "lessThan": "5b4eb82475ae17d55974235c09e97044829426a8", "status": "affected", "versionType": "git"}, {"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "lessThan": "a9651704c6fd64590b5ad4fbe7c3768accf95993", "status": "affected", "versionType": "git"}, {"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "lessThan": "91a482a81eabddebf5430cbbdf12027e1a91b767", "status": "affected", "versionType": "git"}, {"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "lessThan": "2534a5e5d360c2b10203cfa80f4ab9d021e48f2f", "status": "affected", "versionType": "git"}, {"version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "lessThan": "01b245ba016d44861690594e10f67e026ce8552f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/filter.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5b4eb82475ae17d55974235c09e97044829426a8"}, {"url": "https://git.kernel.org/stable/c/a9651704c6fd64590b5ad4fbe7c3768accf95993"}, {"url": "https://git.kernel.org/stable/c/91a482a81eabddebf5430cbbdf12027e1a91b767"}, {"url": "https://git.kernel.org/stable/c/2534a5e5d360c2b10203cfa80f4ab9d021e48f2f"}, {"url": "https://git.kernel.org/stable/c/01b245ba016d44861690594e10f67e026ce8552f"}], "title": "bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/filter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5b4eb82475ae17d55974235c09e97044829426a8", "status": "affected", "version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "versionType": "git"}, {"lessThan": "a9651704c6fd64590b5ad4fbe7c3768accf95993", "status": "affected", "version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "versionType": "git"}, {"lessThan": "91a482a81eabddebf5430cbbdf12027e1a91b767", "status": "affected", "version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "versionType": "git"}, {"lessThan": "2534a5e5d360c2b10203cfa80f4ab9d021e48f2f", "status": "affected", "version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "versionType": "git"}, {"lessThan": "01b245ba016d44861690594e10f67e026ce8552f", "status": "affected", "version": "4ddbcb886268af8d12a23e6640b39d1d9c652b1b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/filter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()\n\nsk_protocol lives in struct sock, not in struct sock_common. A timewait\nor request sock handed to bpf_sock_destroy() by the tcp iterator is\nneither, so reading sk->sk_protocol runs past the object:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0\nRead of size 2 at addr ffff8881047d11b4 by task test_progs/428\n\nTainted: [W]=WARN\nCall Trace:\n <TASK>\n dump_stack_lvl+0x91/0xf0\n print_report+0xd1/0x630\n kasan_report+0xf3/0x130\n __asan_report_load2_noabort+0x14/0x30\n bpf_sock_destroy+0xc7/0xe0\n bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7\n bpf_iter_run_prog+0x538/0xde0\n bpf_iter_tcp_seq_show+0x26b/0x4b0\n bpf_seq_read+0x424/0x1210\n vfs_read+0x197/0xe40\n ksys_read+0x119/0x240\n __x64_sys_read+0x72/0xc0\n x64_sys_call+0x647/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nOnly check sk_protocol on full socks. tcp_abort() already knows how to\ndeal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it\nnever matched the code."}], "id": "CVE-2026-98384", "lastModified": "2026-10-19T10:18:41.760", "metrics": {}, "published": "2026-10-09T08:16:56.940", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/01b245ba016d44861690594e10f67e026ce8552f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2534a5e5d360c2b10203cfa80f4ab9d021e48f2f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b4eb82475ae17d55974235c09e97044829426a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/91a482a81eabddebf5430cbbdf12027e1a91b767"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a9651704c6fd64590b5ad4fbe7c3768accf95993"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()", "id": "2548394", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548394"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()\nsk_protocol lives in struct sock, not in struct sock_common. A timewait\nor request sock handed to bpf_sock_destroy() by the tcp iterator is\nneither, so reading sk->sk_protocol runs past the object:\n==================================================================\nBUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0\nRead of size 2 at addr ffff8881047d11b4 by task test_progs/428\nTainted: [W]=WARN\nCall Trace:\n<TASK>\ndump_stack_lvl+0x91/0xf0\nprint_report+0xd1/0x630\nkasan_report+0xf3/0x130\n__asan_report_load2_noabort+0x14/0x30\nbpf_sock_destroy+0xc7/0xe0\nbpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7\nbpf_iter_run_prog+0x538/0xde0\nbpf_iter_tcp_seq_show+0x26b/0x4b0\nbpf_seq_read+0x424/0x1210\nvfs_read+0x197/0xe40\nksys_read+0x119/0x240\n__x64_sys_read+0x72/0xc0\nx64_sys_call+0x647/0x27e0\ndo_syscall_64+0xe5/0x610\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nOnly check sk_protocol on full socks. tcp_abort() already knows how to\ndeal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it\nnever matched the code.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. When processing socket destruction requests through the bpf_sock_destroy() helper, the kernel fails to properly verify if a socket is a full socket before attempting to read its protocol field, causing an out-of-bounds memory read. A local user authorized to execute BPF programs can exploit this vulnerability to cause a system crash, resulting in a Denial of Service (DoS), or potentially disclose sensitive kernel memory."], "name": "CVE-2026-98384", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98384\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98384\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98384.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ddbcb886268af8d12a23e6640b39d1d9c652b1b,5b4eb82475ae17d55974235c09e97044829426a8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ddbcb886268af8d12a23e6640b39d1d9c652b1b,a9651704c6fd64590b5ad4fbe7c3768accf95993)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ddbcb886268af8d12a23e6640b39d1d9c652b1b,91a482a81eabddebf5430cbbdf12027e1a91b767)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ddbcb886268af8d12a23e6640b39d1d9c652b1b,2534a5e5d360c2b10203cfa80f4ab9d021e48f2f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4ddbcb886268af8d12a23e6640b39d1d9c652b1b,01b245ba016d44861690594e10f67e026ce8552f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-09T10:00:05.374456+00:00", "updated": "2026-10-11T04:30:17.118621+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}