CVE-2026-98503 (GCVE-0-2026-98503)
Vulnerability from cvelistv5
Published
2026-10-18 15:17
Modified
2026-10-19 09:20
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion for TX_RING packets tpacket_snd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called. A call to skb_orphan calls skb->destructor before the skb is freed. This can cause the slot to be reused while still linked into the skb. Switch to standard zerocopy completion (ubuf_info) so the slot is only released once all references to the payload are freed or copied. Restore skb->destructor to standard sock_wfree. The ubuf_info completion callback can be called with a NULL skb, but only from net_zcopy_put and related API, used by zerocopy implementations that hold their own reference on the uarg, such as MSG_ZEROCOPY. This uarg is only ever completed from skb_zcopy_clear, so skb is always set. To prevent userspace from aliasing in-flight state on shared ring slots, allocate tpacket_uarg per packet, rather than per slot. This adds a small allocation to the transmit path. Use standard kmalloc to allow backporting to stable kernels. The uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt reference. packet_free_tx_ring waits on sk_wmem_alloc before freeing the ring pages. Always allocate vec->deferred for tx_ring so page-backed rings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs before calling tpacket_ubuf_complete. Drop the tx_ring.pg_vec test that tpacket_destruct_skb performed before accessing the slot. The sk_wmem_alloc reference now guarantees that the slot is valid. The test is also not sufficient by itself, as it reads pg_vec without pg_vec_lock, so it can race with packet_set_ring. As a result a slot is released when its payload is copied, which can be before transmission (e.g., in skb_orphan_frags_rx). If copied before skb_tx_timestamp() is called, no slot timestamp is recorded, similar to when skb_orphan() was called early in the datapath before this patch. Revert the now unused previous skb_zcopy_.._nouarg infra. Depends on commit 992cc9f94ca9 ("net/packet: defer vmalloc TX_RING free until skbs finish").
References
Impacted products
Vendor Product Version
Linux Linux Version: 5cd8d46ea1562be80063f53c7c6a5f40224de623
Version: 5cd8d46ea1562be80063f53c7c6a5f40224de623
Version: 5cd8d46ea1562be80063f53c7c6a5f40224de623
Version: 5cd8d46ea1562be80063f53c7c6a5f40224de623
Version: 67f6fba765ef8cb19089d476e3c367212a2fbdfd
Version: f2a67e68dbaeae7c88e5522873d7b908911f9f77
Version: 4.14.86   ≤
Version: 4.19.7   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skbuff.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e67c455d79fbf709a94965f09a2be6bf4f4ba5fd",
              "status": "affected",
              "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623",
              "versionType": "git"
            },
            {
              "lessThan": "eda9bcb721f15a93746a99eabda33d80b86404fd",
              "status": "affected",
              "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623",
              "versionType": "git"
            },
            {
              "lessThan": "2a0c9afefc0ecea2cc30ccfbbbc98182a0986191",
              "status": "affected",
              "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623",
              "versionType": "git"
            },
            {
              "lessThan": "9518405613863d0bf0700927a21367f5942cf058",
              "status": "affected",
              "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "67f6fba765ef8cb19089d476e3c367212a2fbdfd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f2a67e68dbaeae7c88e5522873d7b908911f9f77",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.86",
              "versionType": "semver"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/skbuff.h",
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.86",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use ubuf_info completion for TX_RING packets\n\ntpacket_snd sends skbs with frags pointing into its ring slots. Slots\nare released when skb-\u003edestructor is called.\n\nA call to skb_orphan calls skb-\u003edestructor before the skb is freed.\nThis can cause the slot to be reused while still linked into the skb.\n\nSwitch to standard zerocopy completion (ubuf_info) so the slot is only\nreleased once all references to the payload are freed or copied.\nRestore skb-\u003edestructor to standard sock_wfree.\n\nThe ubuf_info completion callback can be called with a NULL skb, but\nonly from net_zcopy_put and related API, used by zerocopy implementations\nthat hold their own reference on the uarg, such as MSG_ZEROCOPY. This\nuarg is only ever completed from skb_zcopy_clear, so skb is always set.\n\nTo prevent userspace from aliasing in-flight state on shared ring\nslots, allocate tpacket_uarg per packet, rather than per slot. This\nadds a small allocation to the transmit path. Use standard kmalloc to\nallow backporting to stable kernels.\n\nThe uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt\nreference. packet_free_tx_ring waits on sk_wmem_alloc before freeing\nthe ring pages. Always allocate vec-\u003edeferred for tx_ring so page-backed\nrings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs\nbefore calling tpacket_ubuf_complete.\n\nDrop the tx_ring.pg_vec test that tpacket_destruct_skb performed before\naccessing the slot. The sk_wmem_alloc reference now guarantees that the\nslot is valid. The test is also not sufficient by itself, as it reads\npg_vec without pg_vec_lock, so it can race with packet_set_ring.\n\nAs a result a slot is released when its payload is copied, which can\nbe before transmission (e.g., in skb_orphan_frags_rx). If copied\nbefore skb_tx_timestamp() is called, no slot timestamp is recorded,\nsimilar to when skb_orphan() was called early in the datapath before\nthis patch.\n\nRevert the now unused previous skb_zcopy_.._nouarg infra.\n\nDepends on commit 992cc9f94ca9 (\"net/packet: defer vmalloc TX_RING\nfree until skbs finish\")."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:20:42.115Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e67c455d79fbf709a94965f09a2be6bf4f4ba5fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/eda9bcb721f15a93746a99eabda33d80b86404fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a0c9afefc0ecea2cc30ccfbbbc98182a0986191"
        },
        {
          "url": "https://git.kernel.org/stable/c/9518405613863d0bf0700927a21367f5942cf058"
        }
      ],
      "title": "packet: use ubuf_info completion for TX_RING packets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98503",
    "datePublished": "2026-10-18T15:17:03.904Z",
    "dateReserved": "2026-09-25T10:25:14.353Z",
    "dateUpdated": "2026-10-19T09:20:42.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.