CVE-2026-98595: Linux kernel · udp: remove a disconnected socket from the 4-tuple hash table
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in d1b5fd969cc53f29d02b82b05a45135de4a6087a : update Linux kernel when convenient.
Data as of 26 Oct 2026, 12:55 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in d1b5fd969cc53f29d02b82b05a45135de4a6087a, c21daf37d5ce9a4e234b7c42238ac1e6041e28e4, 9e95b1a94c9c49b4ba722251bbca2759b9c51737
Exploitation evidence
Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to d1b5fd969cc53f29d02b82b05a45135de4a6087a, c21daf37d5ce9a4e234b7c42238ac1e6041e28e4 or 9e95b1a94c9c49b4ba722251bbca2759b9c51737.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix for this vulnerability is available and included in Linux kernel version 6.13 and specific commits (d1b5fd969cc53f29d02b82b05a45135de4a6087a, c21daf37d5ce9a4e234b7c42238ac1e6041e28e4, 9e95b1a94c9c49b4ba722251bbca2759b9c51737). Users and administrators should update to these fixed versions to remediate the issue. No additional mitigation steps are indicated.
Description
A vulnerability in the Linux kernel's UDP socket handling causes disconnected sockets to remain in the 4-tuple hash table. This stale entry can lead to unnecessary processing of packets through the 4-tuple lookup and may cause incorrect matching behavior, especially on IPv6. The issue was fixed by ensuring the socket is removed from the hash table before disconnection completes.