VulnerabilityPublished 23 Oct 2026

CVE-2026-98925: Linux kernel · bpf, sockmap: Fix self-redirect copied_seq double-counting

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in ef6f2182fee6b9721c005ccfc6aec0a47f79bbfa : update Linux kernel when convenient.

Data as of 26 Oct 2026, 15:33 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 8% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ef6f2182fee6b9721c005ccfc6aec0a47f79bbfa, dc98def81e3c629e25fcdd5753b1db93aab27ce9, cf9aefb26a071cb8b6fdd761c27e022a1184946d +5

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=6.1.32 <6.1.189 >=6.3.6 <6.4	Fixed in ef6f2182fee6b9721c005ccfc6aec0a47f79bbfa dc98def81e3c629e25fcdd5753b1db93aab27ce9 cf9aefb26a071cb8b6fdd761c27e022a1184946d ae1ffd04e98beefbe5d83335d506b0bcd5c2a6b3 88942054191185c6f8bea5568cbb5614d1e99af9 490a83d6386eec1d29f470c8d7331677fb46c3b7 6.4 6.1.189
LinuxLinux	Affected =6.4	Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel versions 6.1.189, 6.4, and related commits. Users should upgrade to these fixed versions or later to resolve the issue. No additional mitigation steps are required beyond applying the official kernel updates.

Description

A vulnerability in the Linux kernel's BPF sockmap implementation caused double-counting of TCP sequence numbers during self-redirects of packets back to the same socket. This flaw led to incorrect TCP sequence tracking and kernel warnings. The issue has been fixed by changing the handling of self-redirect verdicts to avoid double advancement of sequence counters.

Impact

The vulnerability causes incorrect TCP sequence number accounting in the kernel, which can trigger kernel warnings and potentially disrupt normal TCP socket operations. It affects the integrity of TCP receive message processing but there is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

Summary

CVE-2026-98925 addresses a flaw in the Linux kernel's BPF sockmap feature where a self-redirect of an skb (socket buffer) back to the same socket with BPF_F_INGRESS caused the tcp_sk->copied_seq counter to be incremented twice. This double-counting occurred because sk_psock_verdict_apply() called tcp_eat_skb(), advancing copied_seq, and then the skb was queued and later processed again by tcp_bpf_recvmsg_parser(), which also advanced copied_seq. This led to TCP sequence number inconsistencies and kernel warnings. The fix converts the self-redirect verdict to __SK_PASS early in sk_psock_verdict_apply(), bypassing the __SK_REDIRECT path and ensuring copied_seq is incremented only once. Cross-socket redirects remain unchanged.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 15:33 UTC

Technical details

References

Community reviews

Related threats