Linux kernel: race in tcp_v6_syn_recv_sock() may cause sync flaw
CVE-2026-43198 Published on May 6, 2026
tcp: fix potential race in tcp_v6_syn_recv_sock()
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix potential race in tcp_v6_syn_recv_sock()
Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()
is done too late.
After tcp_v4_syn_recv_sock(), the child socket is already visible
from TCP ehash table and other cpus might use it.
Since newinet->pinet6 is still pointing to the listener ipv6_pinfo
bad things can happen as syzbot found.
Move the problematic code in tcp_v6_mapped_child_init()
and call this new helper from tcp_v4_syn_recv_sock() before
the ehash insertion.
This allows the removal of one tcp_sync_mss(), since
tcp_v4_syn_recv_sock() will call it with the correct
context.
Vulnerability Analysis
CVE-2026-43198 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Incorrect Synchronization
The software utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource. If access to a shared resource is not correctly synchronized, then the resource may not be in a state that is expected by the software. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.
Products Associated with CVE-2026-43198
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-43198 are published in these products:
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below fe89b2f05b854847784f91127319172945c1fadd is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 7178e2a8027423b2af17ab95df73a749a5b72e5b is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 858d2a4f67ff69e645a43487ef7ea7f28f06deae is affected.
- Version 2.6.12 is affected.
- Before 2.6.12 is unaffected.
- Version 6.18.16, <= 6.18.* is unaffected.
- Version 6.19.6, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.
- Version 0:6.12.0-211.28.1.el10_2 and below * is unaffected.
- Version 0:6.12.0-55.84.1.el10_0 and below * is unaffected.
- Version 0:3.10.0-1160.155.1.rt56.1307.el7 and below * is unaffected.
- Version 0:3.10.0-1160.155.1.el7 and below * is unaffected.
- Version 0:4.18.0-553.140.1.rt7.481.el8_10 and below * is unaffected.
- Version 0:4.18.0-553.140.1.el8_10 and below * is unaffected.
- Version 0:4.18.0-305.197.1.el8_4 and below * is unaffected.
- Version 0:4.18.0-305.197.1.el8_4 and below * is unaffected.
- Version 0:4.18.0-372.199.1.el8_6 and below * is unaffected.
- Version 0:4.18.0-372.199.1.el8_6 and below * is unaffected.
- Version 0:4.18.0-477.150.1.el8_8 and below * is unaffected.
- Version 0:4.18.0-477.150.1.el8_8 and below * is unaffected.
- Version 0:5.14.0-687.20.1.el9_8 and below * is unaffected.
- Version 0:5.14.0-284.179.1.el9_2 and below * is unaffected.
- Version 0:5.14.0-284.179.1.rt14.464.el9_2 and below * is unaffected.
- Version 0:5.14.0-427.135.1.el9_4 and below * is unaffected.
- Version 0:5.14.0-570.125.1.el9_6 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.