In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound… (CVE-2026-98595)

The Linux kernel UDP implementation had a flaw where a UDP socket bound to a specific address and port retained its entry in the 4-tuple hash table after disconnection. The __udp_disconnect() function only removed the socket entry as a side effect of rehash or unhash operations, which were skipped under certain lock conditions, leaving stale entries. This caused the hash4 count to remain elevated, forcing all packets for that address and port through the 4-tuple lookup unnecessarily. On IPv6, the stale entry could cause matches with zero source ports due to uncleared sk_v6_daddr, a separate defect not fixed here. The patch removes the socket from the hash table before __udp_disconnect() runs, ensuring no stale entries remain and improving lookup correctness and efficiency.

The vulnerability results in stale UDP socket entries persisting in the kernel's 4-tuple hash table after socket disconnection. This causes unnecessary packet processing overhead as packets continue to be routed through the 4-tuple lookup. On IPv6, it may also lead to incorrect packet matching due to stale address data, though that specific defect is not addressed by this fix. There is no indication of direct security compromise or exploitation in the provided data.

A fix has been implemented in the Linux kernel to remove disconnected UDP sockets from the 4-tuple hash table before disconnection completes. Users should update to a kernel version that includes commit 6996a2d2d0a6 or later, which contains this fix. No other mitigation actions are indicated or necessary.