CVE-2026-98276

What it actually does

Race condition in sock_gettstamp() allows concurrent modification of sk->sk_flags without the socket lock, causing a lost update that clears the SOCK_RCU_FREE bit after udp_lib_get_port() sets it; this leads to immediate socket destruction via sk_destruct() while the UDP receive path holds a stale reference, resulting in use-after-free.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes or escalate privileges, leading to denial of service, potential container or host compromise, and unplanned downtime; with 17 days since publication and stable low EPSS, the immediate operational risk remains contained to systems running vulnerable kernels without the socket locking fix.

How an attack unfolds

A local attacker crafts two threads that race a UDP bind() operation against an SIOCGSTAMPNS_NEW ioctl; one thread sets SOCK_RCU_FREE while the other overwrites the same word to set SOCK_TIMESTAMP, clearing the RCU bit; the socket is then inserted into the lookup table without RCU protection, so a subsequent receive path dereferences the freed object and triggers the slab use-after-free.

How to fix it

Apply the upstream kernel commit that acquires the socket lock in sock_gettstamp() before calling sock_enable_timestamp(); rebuild and boot the fixed kernel; until then restrict untrusted local code execution and monitor for kernel oops involving udp_queue_rcv_one_skb or ipv4_pktinfo_prepare.

How to confirm the fix worked

Boot the patched kernel and confirm via code review or ftrace that sock_lock is held on the SOCK_TIMESTAMP path in sock_gettstamp(); run the original reproducer under KASAN and verify absence of use-after-free reports; check kernel version strings against the fixed commit.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux host
2. Create a UDP socket and start a bind() in one thread
3. Simultaneously issue SIOCGSTAMPNS_NEW ioctl from a second thread
4. Trigger the lost-update window that clears SOCK_RCU_FREE
5. Force a UDP receive path lookup that dereferences the freed socket
6. Execute payload via the resulting use-after-free primitive

How to detect it

Search kernel logs and dmesg for KASAN reports citing slab-use-after-free in ipv4_pktinfo_prepare, udp_queue_rcv_one_skb, or udp_unicast_rcv_skb immediately following bind or timestamp ioctl activity; correlate with process names performing rapid UDP socket operations.

What your security team should do

• Prioritize kernel updates on all multi-tenant or container hosts within the next maintenance window
• Harden local access controls and limit untrusted workloads until patches are deployed
• Add kernel oops and KASAN alert rules to the SIEM for early detection of attempted exploitation