CVE-2026-43198
What it is
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
At a glance
- Exploitability
- Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 0.3% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Why it ranks here
- Exploited in the wild: no, CISA does not list it.
- Exploit odds: 0.3% in the next 30 days (EPSS).
- Severity: 9.8 CRITICAL (CVSS).
- Fix: a patch or advisory is linked.
Details
- Published
- Last modified
- Exploit probability
- 0.3% · EPSS, next 30 days
- Weakness
- CWE-362 · Race condition
- Record status
- Modified
Affected
- Linux Kernel < 6.18.16
- Linux Kernel < 6.19.6
- Linux Kernel 2.6.12
- Linux Kernel 7.0
Attack profile CVSS 3.1 · 9.8
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Is it in your code?
Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.
Read https://cve-list.com/agent/cve/CVE-2026-43198.md and follow it. Check whether this project is affected by CVE-2026-43198. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.
Fix and advisories
- https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b
- https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae
- https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd
References
- https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b
- https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae
- https://git.kernel.org/stable/c/9ed654e340f4c73bc6f0af2fbc90ac293e645ce0
- https://git.kernel.org/stable/c/a7e761ba55efaa9c49e0afdd304bb78167af3429
- https://git.kernel.org/stable/c/aef4a9ae95d1bc4f7897065011e6261026719aeb
- https://git.kernel.org/stable/c/cd644e6dc72eec8d9d988717ea1c54f8668ded69
- https://git.kernel.org/stable/c/dad1fe7db6c6519138430ac8f5e589c18f83bfc9
- https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd
- https://access.redhat.com/errata/RHSA-2026:30129
- https://access.redhat.com/errata/RHSA-2026:33215
- https://access.redhat.com/errata/RHSA-2026:33285
- https://access.redhat.com/errata/RHSA-2026:34094
- https://access.redhat.com/errata/RHSA-2026:34443
- https://access.redhat.com/errata/RHSA-2026:35863
- https://access.redhat.com/errata/RHSA-2026:35894
- https://access.redhat.com/errata/RHSA-2026:35896
- https://access.redhat.com/errata/RHSA-2026:35904
- https://access.redhat.com/errata/RHSA-2026:36073
- https://access.redhat.com/errata/RHSA-2026:36216
- https://access.redhat.com/errata/RHSA-2026:36348
- https://access.redhat.com/errata/RHSA-2026:36349
- https://access.redhat.com/errata/RHSA-2026:41236
- https://access.redhat.com/security/cve/CVE-2026-43198
- https://bugzilla.redhat.com/show_bug.cgi?id=2467228
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json