VulnerabilityPublished 18 Oct 2026

CVE-2026-98643: Linux kernel · bpf: Fix out-of-bounds read of rtt_min in sock_ops

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f, fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d, cba54d142c43ec96d8c4d566f66439e8c0afded7 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f	Fixed in fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d	Fixed in fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < cba54d142c43ec96d8c4d566f66439e8c0afded7	Fixed in cba54d142c43ec96d8c4d566f66439e8c0afded7
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < a8a9becbac93a9f54f4d565f1f3005eb08a7912f	Fixed in a8a9becbac93a9f54f4d565f1f3005eb08a7912f
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < 6785313d4fac96afb21ef193610c1fa88b1a9e64	Fixed in 6785313d4fac96afb21ef193610c1fa88b1a9e64
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < 75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03	Fixed in 75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix for this vulnerability is available and has been applied in the Linux kernel. Users should update to a kernel version that includes the patch identified by the fixed commit hashes provided. No additional mitigation steps are required beyond applying the official fix.

Description

CVE-2026-98643 is a vulnerability in the Linux kernel's BPF sock_ops program where an out-of-bounds read occurs when accessing the rtt_min field. This happens because the code reads rtt_min without verifying the socket type, leading to reading beyond the end of a request_sock structure and leaking adjacent kernel memory. The issue is fixed by adding a guard check to ensure the socket is a fully locked tcp_sock before reading rtt_min.

Impact

The vulnerability allows an out-of-bounds read of kernel memory, potentially leaking sensitive kernel pointers. This could aid an attacker in bypassing kernel address space layout randomization (KASLR) or other kernel memory protections. There is no indication of code execution or privilege escalation directly from this flaw, but leaking kernel memory can facilitate further attacks.

Summary

The vulnerability involves an out-of-bounds read of the rtt_min field in the sock_ops BPF program in the Linux kernel. Specifically, the sock_ops program reads skops->rtt_min without checking if skops->sk is a full tcp_sock or a request_sock. On the tcp_conn_request() path, skops->sk is a request_sock, which is smaller, causing the cast to tcp_sock to read memory beyond the structure boundary. This results in leaking kernel memory, including kernel pointers. The fix applies the SOCK_OPS_GET_FIELD() macro to read rtt_min, which includes a check for a locked full tcp_sock, preventing the out-of-bounds read. The patch removes the manual offset calculation and adds the necessary guard to ensure safe access.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 10:06 UTC

Technical details

References

Community reviews

Related threats