In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt_min in sock_ops A sockops prog reading… (CVE-2026-98643)

The Linux kernel's BPF sock_ops program had a vulnerability where it read the rtt_min field from skops->sk without verifying the socket type. On the tcp_conn_request() path, skops->sk points to a request_sock, which is smaller than tcp_sock. The unchecked cast to tcp_sock led to an out-of-bounds read of rtt_min, leaking adjacent kernel memory, including kernel pointers. The fix involved using SOCK_OPS_GET_FIELD() to guard the cast and read rtt_min.s[0].v only if the socket is a locked full tcp_sock, preventing the out-of-bounds access.

This vulnerability allows a BPF sock_ops program to read out-of-bounds kernel memory, potentially leaking sensitive kernel pointers or other data. This could aid an attacker in bypassing kernel address space layout randomization (KASLR) or other kernel memory protections. No evidence of active exploitation is reported.

A fix is available that adds proper type checking before reading the rtt_min field in sock_ops programs. Users should apply the official Linux kernel patch that replaces the direct read with a guarded read via SOCK_OPS_GET_FIELD(). No additional mitigation is required beyond applying this patch.