CVE-2026-98643

bpf: Fix out-of-bounds read of rtt_min in sock_ops

Published Oct 18, 2026 CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix out-of-bounds read of rtt_min in sock_ops

A sockops prog reading skops->rtt_min never checks the sk type: on the
tcp_conn_request() path sock_ops->sk is a request_sock (non-full), and the
ctx rewrite casts it to a tcp_sock (full) and reads rtt_min past the end of
the request_sock, returning dirty adjacent memory.

SEC("sockops")
int prog(struct bpf_sock_ops *skops)
{
switch (skops->op) {
case BPF_SOCK_OPS_RWND_INIT:
leak = skops->rtt_min; /* reads the request_sock OOB */
...
}
}

For instance one such read returned rtt_min=0xffff8881, the high half of a
leaked kernel pointer.

Guarding that cast is exactly what SOCK_OPS_GET_FIELD() does -- it checks
is_locked_tcp_sock and returns 0 when sock_ops->sk is not a locked full
socket. Every other tcp_sock field in sock_ops goes through it; rtt_min is
the only one open-coded, so it skips the check.

Read rtt_min through SOCK_OPS_GET_FIELD() too. rtt_min is a bit special:
it is a struct minmax and we only want the current min, so pass
rtt_min.s[0].v. That is equivalent to the old hand-computed offset

offsetof(struct tcp_sock, rtt_min) + sizeof_field(struct minmax_sample, t)

(s[0] sits at rtt_min + 0 and .v at + sizeof(.t), i.e. what minmax_get()
returns), so the loaded field is unchanged and only the full-sock guard is
added. The two BUILD_BUG_ON()s that protected the hand-computed offset
are no longer needed.

Before patch:

0: r1 = *(u64 *)(r1 +0) ; r1 = skops->sk
1: r1 = *(u32 *)(r1 +2324) ; ((tcp_sock *)sk)->rtt_min.s[0].v

After patch:

0: *(u64 *)(r1 +56) = r9
1: r9 = *(u8 *)(r1 +50) ; is_locked_tcp_sock
2: if r9 == 0 goto pc+4 ; not a locked full sock -> 0
3: r9 = *(u64 *)(r1 +56)
4: r1 = *(u64 *)(r1 +0) ; r1 = skops->sk
5: r1 = *(u32 *)(r1 +2324) ; rtt_min.s[0].v
6: goto pc+2
7: r9 = *(u64 *)(r1 +56)
8: r1 = 0

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`44f0e43037d3a17b043843ba67610ac7c7e37db6`	affected	< 0c796efa919f52f788c22c79d1f1b70321696b3d
`44f0e43037d3a17b043843ba67610ac7c7e37db6`	affected	< fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d
`44f0e43037d3a17b043843ba67610ac7c7e37db6`	affected	< fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f
`44f0e43037d3a17b043843ba67610ac7c7e37db6`	affected	< a8a9becbac93a9f54f4d565f1f3005eb08a7912f
`44f0e43037d3a17b043843ba67610ac7c7e37db6`	affected	< 3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8
`44f0e43037d3a17b043843ba67610ac7c7e37db6`	affected	< 6785313d4fac96afb21ef193610c1fa88b1a9e64
`44f0e43037d3a17b043843ba67610ac7c7e37db6`	affected	< cba54d142c43ec96d8c4d566f66439e8c0afded7
`44f0e43037d3a17b043843ba67610ac7c7e37db6`	affected	< 75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03

Linux

affected

Version	Status	Constraints
`4.16`	affected	—
`0`	unaffected	< 4.16
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,0c796efa919f52f788c22c79d1f1b70321696b3d)`	affected	code_commit	—
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d)`	affected	code_commit	—
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f)`	affected	code_commit	—
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,a8a9becbac93a9f54f4d565f1f3005eb08a7912f)`	affected	code_commit	—
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8)`	affected	code_commit	—
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,6785313d4fac96afb21ef193610c1fa88b1a9e64)`	affected	code_commit	—
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,cba54d142c43ec96d8c4d566f66439e8c0afded7)`	affected	code_commit	—
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03)`	affected	code_commit	—
`[44f0e43037d3a17b043843ba67610ac7c7e37db6,fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.16`	affected	generic	—
`[0,4.16)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.211% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98643.mbox
https://git.kernel.org/stable/c/0c796efa919f52f788c22c79d1f1b70321696b3d
https://git.kernel.org/stable/c/3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8
https://git.kernel.org/stable/c/6785313d4fac96afb21ef193610c1fa88b1a9e64
https://git.kernel.org/stable/c/75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03
https://git.kernel.org/stable/c/a8a9becbac93a9f54f4d565f1f3005eb08a7912f
https://git.kernel.org/stable/c/cba54d142c43ec96d8c4d566f66439e8c0afded7
https://git.kernel.org/stable/c/fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d
https://git.kernel.org/stable/c/fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f
https://nvd.nist.gov/vuln/detail/CVE-2026-98643
https://www.cve.org/CVERecord?id=CVE-2026-98643

History

Oct 23, 2026 12:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-788

Oct 22, 2026 12:30 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98643.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98643 https://www.cve.org/CVERecord?id=CVE-2026-98643
Metrics	threat_severity `None`	cvssV3_1 `{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}` threat_severity `Low`

Oct 18, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-788

Oct 18, 2026 3:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt_min in sock_ops A sockops prog reading skops->rtt_min never checks the sk type: on the tcp_conn_request() path sock_ops->sk is a request_sock (non-full), and the ctx rewrite casts it to a tcp_sock (full) and reads rtt_min past the end of the request_sock, returning dirty adjacent memory. SEC("sockops") int prog(struct bpf_sock_ops skops) { switch (skops->op) { case BPF_SOCK_OPS_RWND_INIT: leak = skops->rtt_min; / reads the request_sock OOB / ... } } For instance one such read returned rtt_min=0xffff8881, the high half of a leaked kernel pointer. Guarding that cast is exactly what SOCK_OPS_GET_FIELD() does -- it checks is_locked_tcp_sock and returns 0 when sock_ops->sk is not a locked full socket. Every other tcp_sock field in sock_ops goes through it; rtt_min is the only one open-coded, so it skips the check. Read rtt_min through SOCK_OPS_GET_FIELD() too. rtt_min is a bit special: it is a struct minmax and we only want the current min, so pass rtt_min.s[0].v. That is equivalent to the old hand-computed offset offsetof(struct tcp_sock, rtt_min) + sizeof_field(struct minmax_sample, t) (s[0] sits at rtt_min + 0 and .v at + sizeof(.t), i.e. what minmax_get() returns), so the loaded field is unchanged and only the full-sock guard is added. The two BUILD_BUG_ON()s that protected the hand-computed offset are no longer needed. Before patch: 0: r1 = (u64 )(r1 +0) ; r1 = skops->sk 1: r1 = (u32 )(r1 +2324) ; ((tcp_sock )sk)->rtt_min.s[0].v After patch: 0: (u64 )(r1 +56) = r9 1: r9 = (u8 )(r1 +50) ; is_locked_tcp_sock 2: if r9 == 0 goto pc+4 ; not a locked full sock -> 0 3: r9 = (u64 )(r1 +56) 4: r1 = (u64 )(r1 +0) ; r1 = skops->sk 5: r1 = (u32 )(r1 +2324) ; rtt_min.s[0].v 6: goto pc+2 7: r9 = (u64 )(r1 +56) 8: r1 = 0
Title		bpf: Fix out-of-bounds read of rtt_min in sock_ops
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c796efa919f52f788c22c79d1f1b70321696b3d https://git.kernel.org/stable/c/3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8 https://git.kernel.org/stable/c/6785313d4fac96afb21ef193610c1fa88b1a9e64 https://git.kernel.org/stable/c/75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03 https://git.kernel.org/stable/c/a8a9becbac93a9f54f4d565f1f3005eb08a7912f https://git.kernel.org/stable/c/cba54d142c43ec96d8c4d566f66439e8c0afded7 https://git.kernel.org/stable/c/fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d https://git.kernel.org/stable/c/fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f