CVE-2026-98503

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98503", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.353Z", "datePublished": "2026-10-18T15:17:03.904Z", "dateUpdated": "2026-10-19T09:20:42.115Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:20:42.115Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use ubuf_info completion for TX_RING packets\n\ntpacket_snd sends skbs with frags pointing into its ring slots. Slots\nare released when skb->destructor is called.\n\nA call to skb_orphan calls skb->destructor before the skb is freed.\nThis can cause the slot to be reused while still linked into the skb.\n\nSwitch to standard zerocopy completion (ubuf_info) so the slot is only\nreleased once all references to the payload are freed or copied.\nRestore skb->destructor to standard sock_wfree.\n\nThe ubuf_info completion callback can be called with a NULL skb, but\nonly from net_zcopy_put and related API, used by zerocopy implementations\nthat hold their own reference on the uarg, such as MSG_ZEROCOPY. This\nuarg is only ever completed from skb_zcopy_clear, so skb is always set.\n\nTo prevent userspace from aliasing in-flight state on shared ring\nslots, allocate tpacket_uarg per packet, rather than per slot. This\nadds a small allocation to the transmit path. Use standard kmalloc to\nallow backporting to stable kernels.\n\nThe uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt\nreference. packet_free_tx_ring waits on sk_wmem_alloc before freeing\nthe ring pages. Always allocate vec->deferred for tx_ring so page-backed\nrings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs\nbefore calling tpacket_ubuf_complete.\n\nDrop the tx_ring.pg_vec test that tpacket_destruct_skb performed before\naccessing the slot. The sk_wmem_alloc reference now guarantees that the\nslot is valid. The test is also not sufficient by itself, as it reads\npg_vec without pg_vec_lock, so it can race with packet_set_ring.\n\nAs a result a slot is released when its payload is copied, which can\nbe before transmission (e.g., in skb_orphan_frags_rx). If copied\nbefore skb_tx_timestamp() is called, no slot timestamp is recorded,\nsimilar to when skb_orphan() was called early in the datapath before\nthis patch.\n\nRevert the now unused previous skb_zcopy_.._nouarg infra.\n\nDepends on commit 992cc9f94ca9 (\"net/packet: defer vmalloc TX_RING\nfree until skbs finish\")."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/skbuff.h", "net/packet/af_packet.c"], "versions": [{"version": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "lessThan": "e67c455d79fbf709a94965f09a2be6bf4f4ba5fd", "status": "affected", "versionType": "git"}, {"version": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "lessThan": "eda9bcb721f15a93746a99eabda33d80b86404fd", "status": "affected", "versionType": "git"}, {"version": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "lessThan": "2a0c9afefc0ecea2cc30ccfbbbc98182a0986191", "status": "affected", "versionType": "git"}, {"version": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "lessThan": "9518405613863d0bf0700927a21367f5942cf058", "status": "affected", "versionType": "git"}, {"version": "67f6fba765ef8cb19089d476e3c367212a2fbdfd", "status": "affected", "versionType": "git"}, {"version": "f2a67e68dbaeae7c88e5522873d7b908911f9f77", "status": "affected", "versionType": "git"}, {"version": "4.14.86", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.7", "lessThan": "4.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/skbuff.h", "net/packet/af_packet.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e67c455d79fbf709a94965f09a2be6bf4f4ba5fd"}, {"url": "https://git.kernel.org/stable/c/eda9bcb721f15a93746a99eabda33d80b86404fd"}, {"url": "https://git.kernel.org/stable/c/2a0c9afefc0ecea2cc30ccfbbbc98182a0986191"}, {"url": "https://git.kernel.org/stable/c/9518405613863d0bf0700927a21367f5942cf058"}], "title": "packet: use ubuf_info completion for TX_RING packets", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/skbuff.h", "net/packet/af_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e67c455d79fbf709a94965f09a2be6bf4f4ba5fd", "status": "affected", "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "versionType": "git"}, {"lessThan": "eda9bcb721f15a93746a99eabda33d80b86404fd", "status": "affected", "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "versionType": "git"}, {"lessThan": "2a0c9afefc0ecea2cc30ccfbbbc98182a0986191", "status": "affected", "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "versionType": "git"}, {"lessThan": "9518405613863d0bf0700927a21367f5942cf058", "status": "affected", "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623", "versionType": "git"}, {"status": "affected", "version": "67f6fba765ef8cb19089d476e3c367212a2fbdfd", "versionType": "git"}, {"status": "affected", "version": "f2a67e68dbaeae7c88e5522873d7b908911f9f77", "versionType": "git"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.86", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/skbuff.h", "net/packet/af_packet.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use ubuf_info completion for TX_RING packets\n\ntpacket_snd sends skbs with frags pointing into its ring slots. Slots\nare released when skb->destructor is called.\n\nA call to skb_orphan calls skb->destructor before the skb is freed.\nThis can cause the slot to be reused while still linked into the skb.\n\nSwitch to standard zerocopy completion (ubuf_info) so the slot is only\nreleased once all references to the payload are freed or copied.\nRestore skb->destructor to standard sock_wfree.\n\nThe ubuf_info completion callback can be called with a NULL skb, but\nonly from net_zcopy_put and related API, used by zerocopy implementations\nthat hold their own reference on the uarg, such as MSG_ZEROCOPY. This\nuarg is only ever completed from skb_zcopy_clear, so skb is always set.\n\nTo prevent userspace from aliasing in-flight state on shared ring\nslots, allocate tpacket_uarg per packet, rather than per slot. This\nadds a small allocation to the transmit path. Use standard kmalloc to\nallow backporting to stable kernels.\n\nThe uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt\nreference. packet_free_tx_ring waits on sk_wmem_alloc before freeing\nthe ring pages. Always allocate vec->deferred for tx_ring so page-backed\nrings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs\nbefore calling tpacket_ubuf_complete.\n\nDrop the tx_ring.pg_vec test that tpacket_destruct_skb performed before\naccessing the slot. The sk_wmem_alloc reference now guarantees that the\nslot is valid. The test is also not sufficient by itself, as it reads\npg_vec without pg_vec_lock, so it can race with packet_set_ring.\n\nAs a result a slot is released when its payload is copied, which can\nbe before transmission (e.g., in skb_orphan_frags_rx). If copied\nbefore skb_tx_timestamp() is called, no slot timestamp is recorded,\nsimilar to when skb_orphan() was called early in the datapath before\nthis patch.\n\nRevert the now unused previous skb_zcopy_.._nouarg infra.\n\nDepends on commit 992cc9f94ca9 (\"net/packet: defer vmalloc TX_RING\nfree until skbs finish\")."}], "id": "CVE-2026-98503", "lastModified": "2026-10-19T10:19:03.490", "metrics": {}, "published": "2026-10-18T16:17:01.370", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a0c9afefc0ecea2cc30ccfbbbc98182a0986191"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9518405613863d0bf0700927a21367f5942cf058"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e67c455d79fbf709a94965f09a2be6bf4f4ba5fd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eda9bcb721f15a93746a99eabda33d80b86404fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: packet: use ubuf_info completion for TX_RING packets", "id": "2554878", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554878"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-826", "details": ["In the Linux kernel, the following vulnerability has been resolved:\npacket: use ubuf_info completion for TX_RING packets\ntpacket_snd sends skbs with frags pointing into its ring slots. Slots\nare released when skb->destructor is called.\nA call to skb_orphan calls skb->destructor before the skb is freed.\nThis can cause the slot to be reused while still linked into the skb.\nSwitch to standard zerocopy completion (ubuf_info) so the slot is only\nreleased once all references to the payload are freed or copied.\nRestore skb->destructor to standard sock_wfree.\nThe ubuf_info completion callback can be called with a NULL skb, but\nonly from net_zcopy_put and related API, used by zerocopy implementations\nthat hold their own reference on the uarg, such as MSG_ZEROCOPY. This\nuarg is only ever completed from skb_zcopy_clear, so skb is always set.\nTo prevent userspace from aliasing in-flight state on shared ring\nslots, allocate tpacket_uarg per packet, rather than per slot. This\nadds a small allocation to the transmit path. Use standard kmalloc to\nallow backporting to stable kernels.\nThe uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt\nreference. packet_free_tx_ring waits on sk_wmem_alloc before freeing\nthe ring pages. Always allocate vec->deferred for tx_ring so page-backed\nrings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs\nbefore calling tpacket_ubuf_complete.\nDrop the tx_ring.pg_vec test that tpacket_destruct_skb performed before\naccessing the slot. The sk_wmem_alloc reference now guarantees that the\nslot is valid. The test is also not sufficient by itself, as it reads\npg_vec without pg_vec_lock, so it can race with packet_set_ring.\nAs a result a slot is released when its payload is copied, which can\nbe before transmission (e.g., in skb_orphan_frags_rx). If copied\nbefore skb_tx_timestamp() is called, no slot timestamp is recorded,\nsimilar to when skb_orphan() was called early in the datapath before\nthis patch.\nRevert the now unused previous skb_zcopy_.._nouarg infra.\nDepends on commit 992cc9f94ca9 (\"net/packet: defer vmalloc TX_RING\nfree until skbs finish\").", "A flaw was found in the Linux kernel's packet socket implementation. A local user can cause a Denial of Service (DoS) or system instability by triggering premature reuse of transmit ring buffer slots while packet data is still in flight. Because these shared memory slots may be released and reused before transmission is finished, the kernel can experience memory corruption leading to an unexpected crash."], "name": "CVE-2026-98503", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98503\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98503\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98503.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5cd8d46ea1562be80063f53c7c6a5f40224de623,e67c455d79fbf709a94965f09a2be6bf4f4ba5fd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5cd8d46ea1562be80063f53c7c6a5f40224de623,eda9bcb721f15a93746a99eabda33d80b86404fd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5cd8d46ea1562be80063f53c7c6a5f40224de623,2a0c9afefc0ecea2cc30ccfbbbc98182a0986191)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5cd8d46ea1562be80063f53c7c6a5f40224de623,9518405613863d0bf0700927a21367f5942cf058)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "67f6fba765ef8cb19089d476e3c367212a2fbdfd"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "f2a67e68dbaeae7c88e5522873d7b908911f9f77"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.14.86,4.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.19.7,4.20)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:45:07.050029+00:00", "updated": "2026-10-20T20:45:14.327019+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}