CVE-2026-98643: bpf: Fix out-of-bounds read of rtt_min in sock_ops
Noroxi assessment
Priority: Monitor (action score 0/100)
- The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.21% (FIRST EPSS).
- Fixed version: Linux Linux 0c796efa919f52f788c22c79d1f1b70321696b3d, 3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8, 6785313d4fac96afb21ef193610c1fa88b1a9e64; azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 6.6.159.1-1.
- Mentioned 1 time in Turkish national cyber security advisories (siberguvenlik.gov.tr).
Low priority for now. Upgrade to Linux Linux 0c796efa919f52f788c22c79d1f1b70321696b3d, 3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8, 6785313d4fac96afb21ef193610c1fa88b1a9e64; azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 6.6.159.1-1 or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rtt_min in sock_ops A sockops prog reading skops->rtt_min never checks the sk type: on the tcp_conn_request() path sock_ops->sk is a request_sock (non-full), and the ctx rewrite casts it to a tcp_sock (full) and reads rtt_min past the end of the request_sock, returning dirty adjacent memory. SEC("sockops") int prog(struct bpf_sock_ops *skops) { switch (skops->op) { case BPF_SOCK_OPS_RWND_INIT: leak = skops->rtt_min; /* reads the request_sock OOB */ ... } } For instance one such read returned rtt_min=0xffff8881, the high half of a leaked kernel pointer. Guarding that cast is exactly what SOCK_OPS_GET_FIELD() does -- it checks is_locked_tcp_sock and returns 0 when sock_ops->sk is not a locked full socket. Every other tcp_sock field in sock_ops goes through it; rtt_min is the only one open-coded, so it skips the check. Read rtt_min through SOCK_OPS_GET_FIELD() too. rtt_min is a bit special: it is a struct minmax and we only want the current min, so pass rtt_min.s[0].v. That is equivalent to the old hand-computed offset offsetof(struct tcp_sock, rtt_min) + sizeof_field(struct minmax_sample, t) (s[0] sits at rtt_min + 0 and .v at + sizeof(.t), i.e. what minmax_get() returns), so the loaded field is unchanged and only the full-sock guard is added. The two BUILD_BUG_ON()s that protected the hand-computed offset are no longer needed. Before patch: 0: r1 = *(u64 *)(r1 +0) ; r1 = skops->sk 1: r1 = *(u32 *)(r1 +2324) ; ((tcp_sock *)sk)->rtt_min.s[0].v After patch: 0: *(u64 *)(r1 +56) = r9 1: r9 = *(u8 *)(r1 +50) ; is_locked_tcp_sock 2: if r9 == 0 goto pc+4 ; not a locked full sock -> 0 3: r9 = *(u64 *)(r1 +56) 4: r1 = *(u64 *)(r1 +0) ; r1 = skops->sk 5: r1 = *(u32 *)(r1 +2324) ; rtt_min.s[0].v 6: goto pc+2 7: r9 = *(u64 *)(r1 +56) 8: r1 = 0
- Published
- Oct 18, 2026
- Updated
- Oct 19, 2026
- EPSS
- 0.2% · 11th percentile
- CWE
- —
Report tools
Action score
0
Monitor
Low priority for now.
- CVSS
- 0 / 40 · —
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.2%
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- No public exploit code on record
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Running WordPress? Scan your site free with WP Lens
Noroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
—
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 4.16affected
- 44f0e43037d3a17b043843ba67610ac7c7e37db6 and later · before 0c796efa919f52f788c22c79d1f1b70321696b3daffected · git
- 44f0e43037d3a17b043843ba67610ac7c7e37db6 and later · before fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79daffected · git
- 44f0e43037d3a17b043843ba67610ac7c7e37db6 and later · before fd6bf2721933d8c90bc4ce57f3e204c9295e7e3faffected · git
- 44f0e43037d3a17b043843ba67610ac7c7e37db6 and later · before a8a9becbac93a9f54f4d565f1f3005eb08a7912faffected · git
- 44f0e43037d3a17b043843ba67610ac7c7e37db6 and later · before 3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8affected · git
- 44f0e43037d3a17b043843ba67610ac7c7e37db6 and later · before 6785313d4fac96afb21ef193610c1fa88b1a9e64affected · git
- 44f0e43037d3a17b043843ba67610ac7c7e37db6 and later · before cba54d142c43ec96d8c4d566f66439e8c0afded7affected · git
- 44f0e43037d3a17b043843ba67610ac7c7e37db6 and later · before 75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03affected · git
- before 4.16not affected · semver
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| Debian:12 | linux | before 6.1.190-1 | 6.1.190-1 |
| Debian:12 | linux-6.12 | before 6.12.113-1~deb12u1 | 6.12.113-1~deb12u1 |
| Debian:13 | linux | before 6.12.113-1 | 6.12.113-1 |
| Debian:14 | linux | before 7.2.9-1 | 7.2.9-1 |
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-74705udp: fix potential use-after-free in tunnel segmentation40Plan
- CVE-2026-74612veth: fix skb length accounting after XDP frag adjustment40Plan
- CVE-2026-74475vxlan: use neigh_ha_snapshot() in route_shortcircuit()40Plan
Published before and after this one in the same product
- ← EarlierCVE-2026-98641Oct 18, 2026 · bpf, arm64: set up the frame pointer for the exception callback0Monitor
- ← EarlierCVE-2026-98642Oct 18, 2026 · bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk0Monitor
- Later →CVE-2026-98644Oct 18, 2026 · bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()0Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 0c796efa919f52f788c22c79d1f1b70321696b3d | Vendor (CNA) |
| Linux Linux | 3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8 | Vendor (CNA) |
| Linux Linux | 6785313d4fac96afb21ef193610c1fa88b1a9e64 | Vendor (CNA) |
| Linux Linux | 75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03 | Vendor (CNA) |
| Linux Linux | a8a9becbac93a9f54f4d565f1f3005eb08a7912f | Vendor (CNA) |
| Linux Linux | cba54d142c43ec96d8c4d566f66439e8c0afded7 | Vendor (CNA) |
| Linux Linux | fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d | Vendor (CNA) |
| Linux Linux | fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f | Vendor (CNA) |
| azl3 kernel 6.6.157.1-1 on Azure Linux 3.0 | 6.6.159.1-1 · Release Notes | Microsoft (MSRC) |
| debian:linux | 6.1.190-1 · Debian:12 | Package registry (OSV) |
| debian:linux-6.12 | 6.12.113-1~deb12u1 · Debian:12 | Package registry (OSV) |
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
- Published
- Fix recordedsame day
- TodayNov 7, 2026+20 d
FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).
Patch and commit links
Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.
No commit or PR link among the references.
Credits
All researchersFinders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.
No credits in the CNA record.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
No nightly-computed relations.
Chain candidates
An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.
—
Bug bounty scope
No known public program.
Source: bounty-targets-data (public HackerOne, Bugcrowd, Intigriti, YesWeHack listings).
National notice (Türkiye Cybersecurity Directorate / USOM)
Official security notices citing this record; remediation advice is on the agency's page.
- TR-26-1351 · Oct 19, 2026(Linux Kernel Güvenlik Bildirimi)
Technical details
No CVSS vector for this record, so attack conditions can't be derived.
Weakness class (CWE)
—
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
MITRE has no CAPEC/ATT&CK mapping for this CWE.
Change log
- Exploit maturity— → none
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (7 more)Show less
- git.kernel.org/stable/c/3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8
- git.kernel.org/stable/c/6785313d4fac96afb21ef193610c1fa88b1a9e64
- git.kernel.org/stable/c/75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03
- git.kernel.org/stable/c/a8a9becbac93a9f54f4d565f1f3005eb08a7912f
- git.kernel.org/stable/c/cba54d142c43ec96d8c4d566f66439e8c0afded7
- git.kernel.org/stable/c/fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d
- git.kernel.org/stable/c/fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f
Vendor advisories and official records. Exploit/PoC links are deliberately left out.