Cloudanix VulnDB

CVE-2026-98300

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in the Linux kernel's handling of closing IPv6 network connections can produce internal warnings under heavy load, but the chance of real-world problems is very low.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A narrow race window in the Linux kernel TCP IPv6 receive path allows skb_clone_and_charge_r() to be invoked locklessly after a listener socket transitions from TCP_LISTEN to TCP_CLOSE, resulting in incorrect forward_alloc accounting and a warning during inet_sock_destruct.

Why it matters to the business

In high-throughput IPv6 environments, concurrent close and packet receive operations may produce kernel warnings or minor resource-accounting anomalies, with very low likelihood of widespread operational impact or successful exploitation.

How an attack unfolds

An attacker would need to create an IPv6 TCP listener and time a close() operation against an incoming packet in the brief interval between tcp_v6_rcv() and tcp_v6_do_rcv(), attempting to trigger the unprotected call to skb_clone_and_charge_r() on the now-closed socket.

How to fix it

Apply the upstream kernel commit that extends the TCP_LISTEN check to also cover TCP_CLOSE before calling skb_clone_and_charge_r(); rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Verify the presence of the fix by inspecting the tcp_v6_do_rcv() function for the additional TCP_CLOSE state guard; confirm no reproduction of the inet_sock_destruct warning under concurrent close/receive workloads on patched kernels.

Typical attack path

  1. Open an IPv6 TCP socket in LISTEN state
  2. Trigger concurrent close() from one thread while delivering a packet to the same socket from another context
  3. Force the socket state change to TCP_CLOSE inside the race window
  4. Observe the resulting warning in inet_sock_destruct during RCU socket cleanup

How to detect it

Search kernel logs and dmesg for the inet_sock_destruct warning mentioning sk_forward_alloc; correlate with high rates of TCP listener close operations on IPv6 sockets.

What your security team should do

  • Prioritize kernel updates on any systems handling significant IPv6 TCP listener traffic within the next maintenance window
  • Monitor for the specific warning string in kernel logs on production hosts
  • Review downstream distributions for backported fixes once available

The record

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). tcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for TCP_LISTEN since commit 073d89808c06 ("net: fix data-races around sk->sk_forward_alloc"). However, there is still a small race window between tcp_v6_rcv() and tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN to TCP_CLOSE, causing skb_clone_and_charge_r() to be called locklessly and resulting in the splat below. [0] Let's avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well. This is fine for non-listeners because tcp_rcv_state_process() drops skb for TCP_CLOSE and opt_skb was freed immediately anyway. [0]: sk->sk_forward_alloc WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28 Modules linked in: CPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162 Code: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff ff e8 c2 5b 83 f8 90 0f 0b 90 e9 c5 fe ff ff e8 b4 5b 83 f8 90 <0f> 0b 90 e9 04 ff ff ff e8 a6 5b 83 f8 90 0f 0b 90 e9 65 fe ff ff RSP: 0018:ffffc90000677bb8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880117bde80 RCX: ffffffff8957eb41 RDX: ffff88801dad5d00 RSI: ffffffff8957ec3c RDI: 0000000000000005 RBP: 00000000fffff000 R08: ffffffff8957eb41 R09: 00000000fffff000 R10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880117bdf10 R14: ffffffff81c08eb7 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8880d7ae5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f93a1021138 CR3: 00000000207a9000 CR4: 0000000000350ef0 Call Trace: <TASK> __sk_destruct+0x82/0xae0 net/core/sock.c:2356 rcu_do_batch kernel/rcu/tree.c:2645 [inline] rcu_core+0x59c/0x1100 kernel/rcu/tree.c:2897 handle_softirqs+0x1e4/0x9b0 kernel/softirq.c:622 run_ksoftirqd kernel/softirq.c:1076 [inline] run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068 smpboot_thread_fn+0x458/0xc80 kernel/smpboot.c:160 kthread+0x396/0x4a0 kernel/kthread.c:436 ret_from_fork+0x8e0/0xe40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>

Affected packages

Ecosystem Package Introduced Fixed