CVE-2026-98300: Linux Kernel TCP Race Condition Vulnerability

CVE-2026-98300 Overview

CVE-2026-98300 is a race condition vulnerability in the Linux kernel's IPv6 TCP receive path. The flaw exists in tcp_v6_do_rcv(), where a small race window between tcp_v6_rcv() and tcp_v6_do_rcv() allows a concurrent close() to transition a socket from TCP_LISTEN to TCP_CLOSE. During that window, skb_clone_and_charge_r() can be called locklessly against the closing listener, corrupting sk->sk_forward_alloc accounting and triggering a warning in inet_sock_destruct().

Critical Impact
The race leads to kernel memory accounting corruption and a WARNING splat in net/ipv4/af_inet.c:162, which can destabilize affected hosts handling concurrent IPv6 TCP listener close operations.

Affected Products

Linux kernel (upstream net/ipv6 TCP stack)
Distributions shipping kernels before the fix commits referenced in git.kernel.org
Systems running IPv6 TCP services that frequently open and close listener sockets

Discovery Timeline

2026-10-06 - CVE-2026-98300 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-98300

Vulnerability Analysis

The defect is a kernel race condition [CWE-362] in the IPv6 TCP input path. Since commit 073d89808c06 ("net: fix data-races around sk->sk_forward_alloc"), tcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for sockets in TCP_LISTEN. However, the state check and the subsequent call are not atomic with respect to a parallel close(). A thread executing tcp_v6_do_rcv() can observe a non-TCP_LISTEN state after close() moves the socket to TCP_CLOSE, then still invoke skb_clone_and_charge_r() without proper locking.

The lockless charge mutates sk->sk_forward_alloc on a socket already in teardown. When __sk_destruct() later runs via RCU, inet_sock_destruct() asserts that sk_forward_alloc is zero and emits the warning observed in the stack trace at net/ipv4/af_inet.c:162.

Root Cause

The root cause is a missing state guard for TCP_CLOSE in the backlog processing path of tcp_v6_do_rcv(). The previous fix narrowed the problem to listeners but did not account for the transition TCP_LISTEN → TCP_CLOSE happening between the dispatcher and the handler.

Attack Vector

Triggering the race requires concurrent IPv6 TCP traffic to a listener that is being closed. The condition is primarily reachable by local workloads that rapidly cycle IPv6 listeners while receiving traffic. No authentication bypass or remote code execution is implied by the published report; the observable impact is kernel accounting corruption and a WARN splat.

See the upstream fix commits for the exact source changes, including 1cb7f292a337, 3e3394a13b60, 56d38839ef0b, 619bfbaacbff, 7d94602e77a4, 8e759cd1f644, a23a3bc5004d, and b727e3d58cb9 at git.kernel.org.

Detection Methods for CVE-2026-98300

Indicators of Compromise

Kernel log entries referencing WARNING: net/ipv4/af_inet.c:162 with inet_sock_destruct+0x... in the call trace.
Stack traces showing __sk_destruct invoked from rcu_do_batch under ksoftirqd after IPv6 TCP listener churn.
Unexpected sk->sk_forward_alloc accounting messages in dmesg on hosts running pre-patch kernels.

Detection Strategies

Monitor kernel ring buffer and journald for the specific inet_sock_destruct warning signature on Linux hosts serving IPv6 TCP.
Correlate warning events with workloads that frequently open and close IPv6 listener sockets (load balancers, test harnesses, container restarts).
Track installed kernel versions against the fixed stable release trees referenced in the upstream commits.

Monitoring Recommendations

Forward dmesg/kmsg to a centralized log platform and alert on af_inet.c:162 warnings.
Audit kernel package inventory for hosts that have not received the patched kernel build.
Baseline the rate of TCP listener socket churn so anomalous spikes correlated with warnings are easier to spot.

How to Mitigate CVE-2026-98300

Immediate Actions Required

Identify Linux hosts running IPv6 TCP services on kernels predating the fix commits listed by git.kernel.org.
Schedule kernel upgrades to a stable release containing the backport that skips skb_clone_and_charge_r() for both TCP_LISTEN and TCP_CLOSE states.
Prioritize systems that handle high rates of IPv6 listener creation and teardown.

Patch Information

The upstream fix extends the existing guard so that tcp_v6_do_rcv() also avoids skb_clone_and_charge_r() when the socket has already transitioned to TCP_CLOSE. The behavior remains correct for non-listener sockets because tcp_rcv_state_process() drops the skb for TCP_CLOSE. Apply the stable kernel updates referenced in the external commits, including commit 1cb7f292, commit 3e3394a1, commit 56d38839, commit 619bfbaa, commit 7d94602e, commit 8e759cd1, commit a23a3bc5, and commit b727e3d5.

Workarounds

No vendor-sanctioned workaround exists; applying the kernel patch is the recommended remediation.
Where patching is delayed, reduce frequency of IPv6 TCP listener close operations in production workloads to narrow the race window.
Restrict exposure of IPv6 TCP services with high listener churn to trusted networks until the fix is deployed.

bash

# Verify running kernel and check for the fix
uname -r
# Confirm distribution kernel package includes the backport
# (replace with your package manager)
# Debian/Ubuntu:
apt-cache policy linux-image-$(uname -r)
# RHEL/CentOS/Rocky:
rpm -q --changelog kernel | grep -i 'tcp_v6_do_rcv\|skb_clone_and_charge_r' | head