CRITICAL Introduced in 2.6.12
net/tcp SynRecv Race
CVE-2026-43198
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.4HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
02KernelScan AI Analysis
Risk summary
A race condition in TCP IPv6 socket creation allows remote attackers to trigger memory corruption during high connection load. The vulnerability affects systems accepting IPv6-mapped IPv4 TCP connections and can lead to kernel crashes or potential code execution.
Vulnerability analysis
The race occurs in tcp_v6_syn_recv_sock() where IPv6-specific socket initialization happens after the socket becomes visible in the TCP ehash table via tcp_v4_syn_recv_sock(). During the window between ehash insertion and IPv6 initialization, other CPUs can access the socket while newinet->pinet6 still points to the listener's ipv6_pinfo structure instead of the child's copy. The fix moves initialization into tcp_v6_mapped_child_init() and calls it before ehash insertion, eliminating the race window. This is network-reachable but requires precise timing and high connection load to exploit.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.12 | 5.10.270 | aef4a9ae95d1 |
| 5.15 | 2.6.12 | 5.15.221 | dad1fe7db6c6 |
| 6.1 | 2.6.12 | 6.1.188 | a7e761ba55ef |
| 6.12 | 2.6.12 | 6.12.110 | 9ed654e340f4 |
| 6.18 | 2.6.12 | 6.18.16 | fe89b2f05b85 |
| 6.19 | 2.6.12 | 6.19.6 | 7178e2a80274 |
| 6.6 | 2.6.12 | 6.6.157 | cd644e6dc72e |
| mainline | 2.6.12 | 7.0 | 858d2a4f67ff |
| cip/5.10 | 2.6.12 | 5.10.271-cip78 | aef4a9ae95d1 |
| cip/5.10-rt | 2.6.12 | 5.10.272-cip79-rt35 | aef4a9ae95d1 |
| cip/6.1 | 2.6.12 | 6.1.189-cip61 | a7e761ba55ef |
| cip/6.1-rt | 2.6.12 | 6.1.189-cip61-rt32 | a7e761ba55ef |
| cip/6.12 | 2.6.12 | 6.12.111-cip32 | 9ed654e340f4 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Fixed in 5.10.272-cip79-rt35 |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |