{"id":"CVE-2026-43198","revision":"e73b731c43da4043865e45f35ff3a60f","records":[{"revision":"e73b731c43da4043865e45f35ff3a60f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43198","aliases":[],"title":"tcp: fix potential race in tcp_v6_syn_recv_sock()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix potential race in tcp_v6_syn_recv_sock()\n\nCode in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()\nis done too late.\n\nAfter tcp_v4_syn_recv_sock(), the child socket is already visible\nfrom TCP ehash table and other cpus might use it.\n\nSince newinet->pinet6 is still pointing to the listener ipv6_pinfo\nbad things can happen as syzbot found.\n\nMove the problematic code in tcp_v6_mapped_child_init()\nand call this new helper from tcp_v4_syn_recv_sock() before\nthe ehash insertion.\n\nThis allows the removal of one tcp_sync_mss(), since\ntcp_v4_syn_recv_sock() will call it with the correct\ncontext.","state":0,"publishedAt":"2026-05-06T11:28:05.569+00:00","modifiedAt":"2026-10-19T19:16:23.821+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/inet_connection_sock.h\",\n                        \"include/net/tcp.h\",\n                        \"net/ipv4/syncookies.c\",\n                        \"net/ipv4/tcp_fastopen.c\",\n                        \"net/ipv4/tcp_ipv4.c\",\n                        \"net/ipv4/tcp_minisocks.c\",\n                        \"net/ipv6/tcp_ipv6.c\",\n                        \"net/mptcp/subflow.c\",\n                        \"net/smc/af_smc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"aef4a9ae95d1bc4f7897065011e6261026719aeb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"dad1fe7db6c6519138430ac8f5e589c18f83bfc9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"a7e761ba55efaa9c49e0afdd304bb78167af3429\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"cd644e6dc72eec8d9d988717ea1c54f8668ded69\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"9ed654e340f4c73bc6f0af2fbc90ac293e645ce0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"fe89b2f05b854847784f91127319172945c1fadd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"7178e2a8027423b2af17ab95df73a749a5b72e5b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2\",\n                            \"lessThan\": \"858d2a4f67ff69e645a43487ef7ea7f28f06deae\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/net/inet_connection_sock.h\",\n                        \"include/net/tcp.h\",\n                        \"net/ipv4/syncookies.c\",\n                        \"net/ipv4/tcp_fastopen.c\",\n                        \"net/ipv4/tcp_ipv4.c\",\n                        \"net/ipv4/tcp_minisocks.c\",\n                        \"net/ipv6/tcp_ipv6.c\",\n                        \"net/mptcp/subflow.c\",\n                        \"net/smc/af_smc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.16\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.6\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/aef4a9ae95d1bc4f7897065011e6261026719aeb","https://git.kernel.org/stable/c/dad1fe7db6c6519138430ac8f5e589c18f83bfc9","https://git.kernel.org/stable/c/a7e761ba55efaa9c49e0afdd304bb78167af3429","https://git.kernel.org/stable/c/cd644e6dc72eec8d9d988717ea1c54f8668ded69","https://git.kernel.org/stable/c/9ed654e340f4c73bc6f0af2fbc90ac293e645ce0","https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd","https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b","https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43198","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43198","identifiers":["CVE-2026-43198"]},"retained":false,"historicalAffected":[]}],"coverage":[]}