CVE-2026-98276: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98276 Overview

CVE-2026-98276 is a race condition in the Linux kernel networking subsystem that leads to a use-after-free (UAF) condition on UDP sockets. The flaw resides in sock_gettstamp(), which modifies sk->sk_flags without holding the socket lock. Because sock_set_flag() and sock_reset_flag() perform non-atomic read-modify-write operations through __set_bit() and __clear_bit(), concurrent updates can lose state. A SIOCGSTAMPNS_NEW ioctl racing with bind() can clear the SOCK_RCU_FREE bit that udp_lib_get_port() just set, causing sk_destruct() to free a socket still reachable by lockless UDP receive lookups.

Critical Impact
Local unprivileged attackers can trigger a UDP socket use-after-free in the kernel, enabling potential privilege escalation or kernel memory corruption.

Affected Products

Linux kernel (upstream) — multiple stable branches prior to the fix
Kernel version 6.12.95 confirmed vulnerable per the KASAN report
Distributions shipping affected stable kernels (see vendor advisories)

Discovery Timeline

Vulnerability reported by Jungwoo Lee and Wongi Lee
2026-10-06 - CVE-2026-98276 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-98276

Vulnerability Analysis

The Linux kernel exposes sock_gettstamp() to user space via the SIOCGSTAMPNS_NEW ioctl. When a caller requests a packet timestamp and timestamping is not already enabled, the function invokes sock_enable_timestamp(sk, SOCK_TIMESTAMP). This path mutates sk->sk_flags through non-atomic bit operations without acquiring the socket lock.

Concurrent paths such as bind() also mutate sk->sk_flags — specifically setting SOCK_RCU_FREE inside udp_lib_get_port() before publishing the socket to the UDP hash table via sk_add_node_rcu(). When both threads read the same sk_flags word, compute independent updates, and write back, one update is lost.

If the SOCK_RCU_FREE bit is dropped after the socket becomes visible to lockless lookups, sk_destruct() frees the socket immediately on close instead of deferring to an RCU grace period. The UDP receive path, which holds a reference-less pointer under RCU, then dereferences freed memory. KASAN confirms the issue with a slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410 reached from udp_queue_rcv_one_skb.

Root Cause

The underlying defect is a missing synchronization primitive. sk->sk_flags must only be modified while holding the socket lock because sock_set_flag() and sock_reset_flag() are implemented with non-atomic __set_bit() and __clear_bit(). sock_gettstamp() violated this invariant, creating a lost-update race with any other flag mutator running on a different CPU.

Attack Vector

Exploitation requires local code execution with the ability to open a UDP socket and issue the SIOCGSTAMPNS_NEW ioctl concurrently with bind() on the same descriptor from another thread. No elevated privileges are required to open the socket. Successful races produce a dangling socket pointer that the kernel receive path dereferences, yielding a kernel-mode use-after-free suitable for memory corruption or privilege escalation primitives.

The upstream fix acquires the socket lock in sock_gettstamp() only when SOCK_TIMESTAMP must be set, preserving the lockless fast path. See kernel git commits 17b2a1e, 18899e2, and d9f96bc for the backports.

Detection Methods for CVE-2026-98276

Indicators of Compromise

KASAN reports of slab-use-after-free in ipv4_pktinfo_prepare, udp_queue_rcv_one_skb, or udp_unicast_rcv_skb on affected kernels.
Unexplained kernel oops or panics in the UDP receive path shortly after processes issue SIOCGSTAMPNS_NEW ioctls.
Processes repeatedly invoking bind() and ioctl(SIOCGSTAMPNS_NEW) on the same UDP socket from different threads.

Detection Strategies

Enable KASAN on test and staging kernels to surface the use-after-free when exercised by fuzzers such as syzkaller.
Audit auditd logs for untrusted local processes making dense sequences of UDP bind and ioctl syscalls.
Monitor dmesg for kernel warnings referencing sock_gettstamp, udp_lib_get_port, or RCU-related socket destruction anomalies.

Monitoring Recommendations

Collect kernel ring buffer output centrally and alert on KASAN or BUG strings tied to UDP or socket destruction.
Track installed kernel package versions across the fleet and flag hosts that have not received the backported fix.
Review EDR telemetry for low-privilege processes performing unusual kernel-exercising syscall patterns on multi-core hosts.

How to Mitigate CVE-2026-98276

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that includes the sock_gettstamp() locking fix.
Inventory hosts running kernel 6.12.x and earlier affected stable branches, prioritizing multi-tenant and container hosts.
Restrict untrusted local code execution on sensitive systems until patches are deployed.

Patch Information

The fix is distributed across multiple stable branches. Reference commits: 17b2a1e, 18899e2, 1f73253, 3b12d39, 88c8048, 899650b, 9ed55f3, and d9f96bc. Install the vendor-supplied kernel package that incorporates these commits and reboot.

Workarounds

No reliable in-kernel workaround exists without the patch; the race is inherent to the unlocked flag update.
Use mandatory access controls such as SELinux or AppArmor to confine processes that do not require raw socket ioctls.
Apply seccomp filters to block the SIOCGSTAMPNS_NEW ioctl for sandboxed workloads where socket timestamps are not needed.

bash

# Verify installed kernel version and confirm patch presence
uname -r

# Debian / Ubuntu
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot

# RHEL / Rocky / Alma
sudo dnf update kernel
sudo reboot

# Example seccomp filter snippet (pseudocode) to deny SIOCGSTAMPNS_NEW
# ioctl(fd, SIOCGSTAMPNS_NEW, ...) -> return EPERM