9.8
Critique
CVE-2026-43198 In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock()…
Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Linux 7.0 | premières → < 7.0 | 7.0 |
| Linux 6.19 | premières → < 6.19.6 | 6.19.6 |
| Linux 6.18 | premières → < 6.18.16 | 6.18.16 |
| Linux 6.12 | premières → < 6.12.110 | 6.12.110 |
| Linux 6.6 | premières → < 6.6.157 | 6.6.157 |
| Linux 6.1 | premières → < 6.1.188 | 6.1.188 |
| Linux 5.15 | premières → < 5.15.221 | 5.15.221 |
| Linux 5.10 | premières → < 5.10.270 | 5.10.270 |
| Linux | 2.6.12 | Pas de correctif indiqué |
Afficher les 56 autres branches Masquer les 56 autres branches
Autres CVE de Linux
Les 18300 CVE de Linux →
CVE-2026-99284
net: skbuff: propagate shared-frag marker in skb_zerocopy()
Non notée
CVE-2026-99283
netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
Non notée
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop
Non notée
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device
Non notée