CVE-2026-98299: Linux kernel · tcp: do not let tcp_rmem be set below 4096
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in 879907631b9e70eedb62d76461b29afa106ebe7a : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 879907631b9e70eedb62d76461b29afa106ebe7a, 7898bda1ebc198f5559b301a96dd5398edd4d4d3, 83a945a529d6e002dd7339c532288a931f463dba +5
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
This vulnerability has been fixed by setting the minimum allowed value for tcp_rmem to 4096. Systems should apply the official Linux kernel updates that include this fix. There are no additional mitigations required once the patch is applied.
Description
A vulnerability in the Linux kernel allows tcp_rmem to be set below 4096, which can cause a division by zero error in tcp_rcvbuf_grow() and tcp_rcv_space_adjust(). This occurs when tcp_rmem is configured with very small values, leading to zero divisor in critical TCP buffer calculations and resulting in a kernel crash. The issue has been fixed by enforcing a minimum tcp_rmem value of 4096.
References
- git.kernel.org/stable/c/879907631b9e70eedb62d76461b29afa106ebe7a (opens in a new tab)
- git.kernel.org/stable/c/8e32532d0fa3191ecf9524b0e6bafa0832e712ba (opens in a new tab)
- git.kernel.org/stable/c/67b83c15bed9eeeb8d1a6dbf88a5f79525970173 (opens in a new tab)
- git.kernel.org/stable/c/9a4f49bf8d2da4e52e904f60c29cca317bab9b3a (opens in a new tab)
- git.kernel.org/stable/c/60df201dbb19a1bf6478b56d100f7ae1fe90e46a (opens in a new tab)
- git.kernel.org/stable/c/7898bda1ebc198f5559b301a96dd5398edd4d4d3 (opens in a new tab)
- git.kernel.org/stable/c/1c4bb940c3bb4325bb88ac1b7eaf5faaa39e7d63 (opens in a new tab)
- git.kernel.org/stable/c/83a945a529d6e002dd7339c532288a931f463dba (opens in a new tab)