In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_RESERVE_MEM to TCP sockets and cap max value Commit… (CVE-2026-98801)

The Linux kernel vulnerability (CVE-2026-98801) concerns the SO_RESERVE_MEM socket option, which was incorrectly allowed on UDP sockets despite only being supported for TCP sockets. The original implementation only checked sk_has_account(sk), true for both TCP and UDP, but UDP sockets use different locking mechanisms, leading to potential corruption of sk_forward_alloc and memory controller accounting during concurrent operations. Furthermore, the lack of an upper bound on the SO_RESERVE_MEM value allowed near-INT_MAX values to overflow 32-bit signed integers, corrupting internal memory accounting fields. The resolution restricts SO_RESERVE_MEM to TCP sockets (sk_is_tcp(sk)) and enforces a maximum value of 1GB to prevent overflow and ensure consistent memory accounting.

If exploited, this vulnerability could cause memory accounting corruption in the Linux kernel's networking stack, potentially leading to instability or denial of service. The corruption arises from concurrent UDP socket operations and unchecked large values for SO_RESERVE_MEM. However, the vulnerability is limited to misuse of the SO_RESERVE_MEM socket option and does not affect UDP sockets due to the fix restricting its use to TCP sockets.

The vulnerability has been resolved by restricting SO_RESERVE_MEM usage to TCP sockets and capping the maximum value to 1GB. Users should apply the official Linux kernel updates that include these fixes. There is no indication of existing exploits in the wild. No additional mitigation steps are required beyond updating to a patched kernel version.