In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion for TX_RING packets tpacket_snd sends skbs with… (CVE-2026-98503)

The Linux kernel vulnerability CVE-2026-98503 relates to the packet TX_RING implementation where skbs with fragments pointing into ring slots could have their slots prematurely released due to early invocation of skb->destructor via skb_orphan. This could cause reuse of slots still linked to skbs, risking memory corruption. The patch replaces the custom completion with the standard ubuf_info zerocopy completion callback, ensuring slots are released only after all references to the payload are cleared. Additional changes include per-packet allocation of tpacket_uarg to prevent aliasing in shared ring slots, and synchronization improvements using sk_wmem_alloc references to guarantee slot validity. The fix reverts obsolete infrastructure and depends on a prior commit deferring TX_RING free until skbs finish.

The vulnerability could lead to premature reuse of packet ring slots while still referenced by socket buffers, potentially causing memory corruption or data integrity issues in packet transmission. This may affect network stack stability and reliability. No confirmed exploits in the wild are known.

A fix has been implemented in the Linux kernel to address this vulnerability by adopting standard zerocopy completion and improving synchronization of ring slot release. Users should update to the patched kernel versions once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.