Out-of-bounds read in Linux kernel - CVE-2026-98384

Vulnerability details

The vulnerability allows a local user to trigger an out-of-bounds memory read.

The vulnerability exists due to an out-of-bounds read in bpf_sock_destroy() when processing a timewait or request socket supplied by the TCP iterator. A local user can invoke bpf_sock_destroy() through a TCP iterator BPF program with such a socket to trigger an out-of-bounds memory read.

The sk_protocol field belongs to struct sock and is not present in struct sock_common or the supplied socket objects.

Affected software

How to mitigate CVE-2026-98384

External References

• https://git.kernel.org/stable/c/01b245ba016d44861690594e10f67e026ce8552f
• https://git.kernel.org/stable/c/2534a5e5d360c2b10203cfa80f4ab9d021e48f2f
• https://git.kernel.org/stable/c/5b4eb82475ae17d55974235c09e97044829426a8
• https://git.kernel.org/stable/c/91a482a81eabddebf5430cbbdf12027e1a91b767
• https://git.kernel.org/stable/c/a9651704c6fd64590b5ad4fbe7c3768accf95993

Related Security Bulletins

• Out-of-bounds read in Linux kernel core
• Debian update for linux