CVE-2026-43198: Linux Kernel Race Condition Vulnerability

CVE-2026-43198 Overview

CVE-2026-43198 is a race condition vulnerability in the Linux kernel's TCP/IPv6 stack. The flaw resides in the tcp_v6_syn_recv_sock() function, where post-processing code executes too late after the call to tcp_v4_syn_recv_sock(). By the time this code runs, the newly created child socket is already inserted into the TCP ehash table and visible to other CPUs, while newinet->pinet6 still points to the listener's ipv6_pinfo structure. This window allows concurrent operations on an inconsistent socket state, which syzbot reproduced as exploitable behavior. The kernel maintainers resolved the issue by introducing a tcp_v6_mapped_child_init() helper invoked before the ehash insertion.

Critical Impact
A race condition in IPv4-mapped IPv6 TCP socket handling can lead to memory corruption or kernel instability when concurrent CPUs operate on a partially initialized child socket.

Affected Products

Linux kernel TCP/IPv6 networking stack
Distributions shipping the affected upstream kernel versions prior to the fix commits
Systems using IPv4-mapped IPv6 sockets for TCP connections

Discovery Timeline

2026-05-06 - CVE-2026-43198 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43198

Vulnerability Analysis

The vulnerability is a race condition in the Linux kernel's IPv6 TCP receive path. The function tcp_v6_syn_recv_sock() handles incoming SYN-ACK processing for IPv6 listening sockets, including the IPv4-mapped IPv6 case where it delegates to tcp_v4_syn_recv_sock(). After the v4 helper returns, the v6 caller performs additional initialization on the child socket, including pointer fixups for newinet->pinet6.

The defect is one of ordering. tcp_v4_syn_recv_sock() inserts the new child socket into the global TCP established hash table (ehash) before returning. Once present in ehash, the socket is reachable from other CPUs servicing concurrent packets. Any CPU that locates the child socket through a hash lookup observes a pinet6 pointer that still references the listener's IPv6 control block rather than the child's own.

Root Cause

The root cause is improper sequencing between socket initialization and global visibility. Initialization steps that should complete before the socket becomes reachable were instead performed afterward. Concurrent CPUs operating on the inconsistent state can dereference the listener's ipv6_pinfo while it is being modified or freed, leading to memory corruption, use-after-free, or kernel panic.

Attack Vector

The race is triggered through normal TCP connection establishment on IPv6 listeners using IPv4-mapped addresses under concurrent load. An attacker capable of generating high-volume SYN traffic against an IPv6 socket accepting IPv4 connections can attempt to win the race. The bug was originally surfaced by syzbot fuzzing, indicating it can be reproduced with crafted network input on multi-core systems.

The upstream fix moves the affected code into a new tcp_v6_mapped_child_init() helper, called from tcp_v4_syn_recv_sock() before the ehash insertion. This change also eliminates a redundant tcp_sync_mss() call by ensuring the synchronization happens with the correct context. Patch references are available in the first kernel git commit, the second commit, and the third commit.

Detection Methods for CVE-2026-43198

Indicators of Compromise

Unexplained kernel oops or panic messages referencing tcp_v6_syn_recv_sock, tcp_v4_syn_recv_sock, or inet6_destroy_sock in dmesg and system logs
Slab corruption warnings or KASAN reports involving ipv6_pinfo structures on systems handling concurrent IPv6 TCP connections
Unexpected reboots on hosts terminating high-volume IPv4-mapped IPv6 TCP traffic

Detection Strategies

Audit running kernel versions against the upstream fix commits to identify hosts still exposed
Enable KASAN and lockdep on test kernels to surface the race during reproduction or fuzzing
Correlate kernel crash telemetry with network connection rates on IPv6-enabled servers

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on crash signatures involving the TCP stack
Track patch deployment status across the Linux fleet using configuration management inventory
Monitor IPv6 listener connection rates and pair with crash telemetry to detect potential exploitation attempts

How to Mitigate CVE-2026-43198

Immediate Actions Required

Identify all Linux hosts running unpatched kernel versions, prioritizing internet-facing systems with IPv6 listeners
Apply the distribution-provided kernel update containing the upstream fix and reboot affected systems
For systems that cannot be patched immediately, restrict exposure of IPv6 TCP services to trusted networks

Patch Information

The fix is available in the upstream Linux kernel through three stable commits: 7178e2a8027423b2af17ab95df73a749a5b72e5b, 858d2a4f67ff69e645a43487ef7ea7f28f06deae, and fe89b2f05b854847784f91127319172945c1fadd. The patches introduce tcp_v6_mapped_child_init() and reorder initialization to occur before the child socket is published to the ehash table. Apply the kernel update from your distribution vendor that incorporates these commits.

Workarounds

Disable IPv6 on hosts that do not require it by setting net.ipv6.conf.all.disable_ipv6=1 via sysctl
Restrict IPv6 TCP services with firewall rules to limit exposure to authenticated or internal sources
Reduce concurrency on affected services by lowering listener backlog where feasible until patches are applied

bash

# Verify kernel version and check for the fix
uname -r

# Temporary mitigation: disable IPv6 if not required
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1

# Persist across reboots
echo 'net.ipv6.conf.all.disable_ipv6 = 1' >> /etc/sysctl.conf
echo 'net.ipv6.conf.default.disable_ipv6 = 1' >> /etc/sysctl.conf