VulnerabilityPublished 18 Oct 2026

CVE-2026-98643: Linux kernel · bpf: Fix out-of-bounds read of rtt_min in sock_ops

Source GCVE Database

Authoritative record:CVE-2026-98643· High

Not known to be exploited · fixed in fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f : patch Linux kernel soon.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f, fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d, cba54d142c43ec96d8c4d566f66439e8c0afded7 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-xg7q-jpqp-fc7g

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f	Fixed in fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d	Fixed in fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < cba54d142c43ec96d8c4d566f66439e8c0afded7	Fixed in cba54d142c43ec96d8c4d566f66439e8c0afded7
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < a8a9becbac93a9f54f4d565f1f3005eb08a7912f	Fixed in a8a9becbac93a9f54f4d565f1f3005eb08a7912f
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < 6785313d4fac96afb21ef193610c1fa88b1a9e64	Fixed in 6785313d4fac96afb21ef193610c1fa88b1a9e64
LinuxLinux	Affected ≥ 44f0e43037d3a17b043843ba67610ac7c7e37db6, < 75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03	Fixed in 75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available that adds proper type checking before reading the rtt_min field in sock_ops programs. Users should apply the official Linux kernel patch that replaces the direct read with a guarded read via SOCK_OPS_GET_FIELD(). No additional mitigation is required beyond applying this patch.

Description

A vulnerability in the Linux kernel's BPF sock_ops program allowed an out-of-bounds read of the rtt_min field due to improper type checking. This flaw caused the program to read beyond the end of a request_sock structure by casting it incorrectly to a tcp_sock, potentially leaking kernel memory. The issue was fixed by adding proper checks to ensure the socket is a full tcp_sock before reading rtt_min.

Impact

This vulnerability allows a BPF sock_ops program to read out-of-bounds kernel memory, potentially leaking sensitive kernel pointers or other data. This could aid an attacker in bypassing kernel address space layout randomization (KASLR) or other kernel memory protections. No evidence of active exploitation is reported.

Summary

The Linux kernel's BPF sock_ops program had a vulnerability where it read the rtt_min field from skops->sk without verifying the socket type. On the tcp_conn_request() path, skops->sk points to a request_sock, which is smaller than tcp_sock. The unchecked cast to tcp_sock led to an out-of-bounds read of rtt_min, leaking adjacent kernel memory, including kernel pointers. The fix involved using SOCK_OPS_GET_FIELD() to guard the cast and read rtt_min.s[0].v only if the socket is a locked full tcp_sock, preventing the out-of-bounds access.

References

Community reviews

Loading reviews…