CVE-2026-98801

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98801", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.370Z", "datePublished": "2026-10-18T15:48:47.171Z", "dateUpdated": "2026-10-19T09:25:54.691Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:25:54.691Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: restrict SO_RESERVE_MEM to TCP sockets and cap max value\n\nCommit 2bb2f5fb21b0 (\"net: add new socket option SO_RESERVE_MEM\") and\ncommit d00c8ee31729 (\"net: fix possible NULL deref in sock_reserve_memory\")\nonly checked sk_has_account(sk), which is true for both TCP and UDP\nsockets.\n\nHowever, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only\nsupported by TCP:\n- On UDP sockets, sk->sk_forward_alloc is protected by\n sk->sk_receive_queue.lock, whereas sock_reserve_memory() and\n sock_release_reserved_memory() only acquire lock_sock(sk). Concurrent\n UDP packet reception/release and setsockopt(SO_RESERVE_MEM) corrupt\n sk_forward_alloc and memcg accounting.\n- udp_rmem_release() reclaims excess sk_forward_alloc without\n accounting for sk_unused_reserved_mem(sk).\n\nRestrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now.\nSupporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and\nhonoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in\na future net-next series if needed.\n\nIn addition, reject val > SZ_1G with -EINVAL in\nsk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near\nINT_MAX cause sk_mem_pages(delta) and (pages << PAGE_SHIFT) to overflow\n32-bit signed int, corrupting sk->sk_forward_alloc and\nsk->sk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the\npage-rounded sk->sk_reserved_mem reported by getsockopt(SO_RESERVE_MEM)\ncan always be passed back to setsockopt(SO_RESERVE_MEM)."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/sock.c"], "versions": [{"version": "2bb2f5fb21b0486ff69b7b4a1fe03a760527d133", "lessThan": "492e04f9a00f3cc88a1f6899417b10f3019a624e", "status": "affected", "versionType": "git"}, {"version": "2bb2f5fb21b0486ff69b7b4a1fe03a760527d133", "lessThan": "5069ce898148bd799395c5a464e006cbb840f188", "status": "affected", "versionType": "git"}, {"version": "2bb2f5fb21b0486ff69b7b4a1fe03a760527d133", "lessThan": "a467b05b201b5c26be52ed3081992fa9c0387648", "status": "affected", "versionType": "git"}, {"version": "2bb2f5fb21b0486ff69b7b4a1fe03a760527d133", "lessThan": "37e02c42a00be692c06343e11779aadc45f45971", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/sock.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/492e04f9a00f3cc88a1f6899417b10f3019a624e"}, {"url": "https://git.kernel.org/stable/c/5069ce898148bd799395c5a464e006cbb840f188"}, {"url": "https://git.kernel.org/stable/c/a467b05b201b5c26be52ed3081992fa9c0387648"}, {"url": "https://git.kernel.org/stable/c/37e02c42a00be692c06343e11779aadc45f45971"}], "title": "net: restrict SO_RESERVE_MEM to TCP sockets and cap max value", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/sock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "492e04f9a00f3cc88a1f6899417b10f3019a624e", "status": "affected", "version": "2bb2f5fb21b0486ff69b7b4a1fe03a760527d133", "versionType": "git"}, {"lessThan": "5069ce898148bd799395c5a464e006cbb840f188", "status": "affected", "version": "2bb2f5fb21b0486ff69b7b4a1fe03a760527d133", "versionType": "git"}, {"lessThan": "a467b05b201b5c26be52ed3081992fa9c0387648", "status": "affected", "version": "2bb2f5fb21b0486ff69b7b4a1fe03a760527d133", "versionType": "git"}, {"lessThan": "37e02c42a00be692c06343e11779aadc45f45971", "status": "affected", "version": "2bb2f5fb21b0486ff69b7b4a1fe03a760527d133", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/sock.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: restrict SO_RESERVE_MEM to TCP sockets and cap max value\n\nCommit 2bb2f5fb21b0 (\"net: add new socket option SO_RESERVE_MEM\") and\ncommit d00c8ee31729 (\"net: fix possible NULL deref in sock_reserve_memory\")\nonly checked sk_has_account(sk), which is true for both TCP and UDP\nsockets.\n\nHowever, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only\nsupported by TCP:\n- On UDP sockets, sk->sk_forward_alloc is protected by\n sk->sk_receive_queue.lock, whereas sock_reserve_memory() and\n sock_release_reserved_memory() only acquire lock_sock(sk). Concurrent\n UDP packet reception/release and setsockopt(SO_RESERVE_MEM) corrupt\n sk_forward_alloc and memcg accounting.\n- udp_rmem_release() reclaims excess sk_forward_alloc without\n accounting for sk_unused_reserved_mem(sk).\n\nRestrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now.\nSupporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and\nhonoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in\na future net-next series if needed.\n\nIn addition, reject val > SZ_1G with -EINVAL in\nsk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near\nINT_MAX cause sk_mem_pages(delta) and (pages << PAGE_SHIFT) to overflow\n32-bit signed int, corrupting sk->sk_forward_alloc and\nsk->sk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the\npage-rounded sk->sk_reserved_mem reported by getsockopt(SO_RESERVE_MEM)\ncan always be passed back to setsockopt(SO_RESERVE_MEM)."}], "id": "CVE-2026-98801", "lastModified": "2026-10-19T10:19:44.163", "metrics": {}, "published": "2026-10-18T16:17:34.137", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/37e02c42a00be692c06343e11779aadc45f45971"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/492e04f9a00f3cc88a1f6899417b10f3019a624e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5069ce898148bd799395c5a464e006cbb840f188"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a467b05b201b5c26be52ed3081992fa9c0387648"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via improper socket memory reservation handling", "id": "2555104", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555104"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-400", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: restrict SO_RESERVE_MEM to TCP sockets and cap max value\nCommit 2bb2f5fb21b0 (\"net: add new socket option SO_RESERVE_MEM\") and\ncommit d00c8ee31729 (\"net: fix possible NULL deref in sock_reserve_memory\")\nonly checked sk_has_account(sk), which is true for both TCP and UDP\nsockets.\nHowever, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only\nsupported by TCP:\n- On UDP sockets, sk->sk_forward_alloc is protected by\nsk->sk_receive_queue.lock, whereas sock_reserve_memory() and\nsock_release_reserved_memory() only acquire lock_sock(sk). Concurrent\nUDP packet reception/release and setsockopt(SO_RESERVE_MEM) corrupt\nsk_forward_alloc and memcg accounting.\n- udp_rmem_release() reclaims excess sk_forward_alloc without\naccounting for sk_unused_reserved_mem(sk).\nRestrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now.\nSupporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and\nhonoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in\na future net-next series if needed.\nIn addition, reject val > SZ_1G with -EINVAL in\nsk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near\nINT_MAX cause sk_mem_pages(delta) and (pages << PAGE_SHIFT) to overflow\n32-bit signed int, corrupting sk->sk_forward_alloc and\nsk->sk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the\npage-rounded sk->sk_reserved_mem reported by getsockopt(SO_RESERVE_MEM)\ncan always be passed back to setsockopt(SO_RESERVE_MEM).", "A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) or kernel memory corruption by manipulating socket memory reservation settings. Due to a lack of upper-bound validation and missing locking mechanisms when applied to User Datagram Protocol (UDP) sockets, integer overflows and race conditions can corrupt internal memory accounting. This flaw compromises system stability and may lead to a kernel crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98801", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:48:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98801\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98801\nhttps://git.kernel.org/stable/c/37e02c42a00be692c06343e11779aadc45f45971\nhttps://git.kernel.org/stable/c/492e04f9a00f3cc88a1f6899417b10f3019a624e\nhttps://git.kernel.org/stable/c/5069ce898148bd799395c5a464e006cbb840f188\nhttps://git.kernel.org/stable/c/a467b05b201b5c26be52ed3081992fa9c0387648"], "statement": "SO_RESERVE_MEM can corrupt socket and memcg memory accounting through two related flaws. UDP receive and release paths protect sk_forward_alloc with sk_receive_queue.lock, while reservation updates use lock_sock, allowing concurrent operations to race and produce inconsistent accounting. Values near INT_MAX can also overflow sk_mem_pages(delta) and pages shifted by PAGE_SHIFT, corrupting sk_forward_alloc and sk_reserved_mem even without the UDP race. For the CVSS the PR:L value is used because a local process can create a socket and invoke setsockopt without requiring full administrative control. Remote UDP traffic may help exercise the race, but remote packets alone cannot invoke SO_RESERVE_MEM, so the issue is local rather than network reachable. The demonstrated impact is incorrect socket and memcg accounting with possible resource exhaustion or service disruption. A direct UAF, OOB access, arbitrary write, or reliable privilege escalation primitive is not established.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2bb2f5fb21b0486ff69b7b4a1fe03a760527d133,492e04f9a00f3cc88a1f6899417b10f3019a624e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2bb2f5fb21b0486ff69b7b4a1fe03a760527d133,5069ce898148bd799395c5a464e006cbb840f188)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2bb2f5fb21b0486ff69b7b4a1fe03a760527d133,a467b05b201b5c26be52ed3081992fa9c0387648)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2bb2f5fb21b0486ff69b7b4a1fe03a760527d133,37e02c42a00be692c06343e11779aadc45f45971)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:45:06.494667+00:00", "updated": "2026-10-22T20:45:05.386022+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}