Out-of-bounds read in Linux kernel - CVE-2026-98643

Vulnerability identifier: #VU156955

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98643

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local privileged user to disclose adjacent kernel memory, including portions of kernel pointers.

The vulnerability exists due to an out-of-bounds read in the Linux kernel BPF sock_ops context conversion code when processing rtt_min access on the tcp_conn_request() path. A local privileged user can use a sockops BPF program that reads skops->rtt_min during BPF_SOCK_OPS_RWND_INIT to disclose adjacent kernel memory because a request_sock is incorrectly treated as a full tcp_sock without checking the socket type.

Linux kernel
Ubuntu
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-igx (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia-tegra (Ubuntu package) - update to 5.15.0-1070.72
linux-nvidia-tegra-igx (Ubuntu package) - update to 5.15.0-1059.59
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1070.72~20.04.1
linux (Ubuntu package) - update to 7.0.0-42.42
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/0c796efa919f52f788c22c79d1f1b70321696b3d
• https://git.kernel.org/stable/c/3a46f14e6cf375f3ca38f8f6e6524749e24ea0a8
• https://git.kernel.org/stable/c/6785313d4fac96afb21ef193610c1fa88b1a9e64
• https://git.kernel.org/stable/c/75f8cf22463d82bb1fb0239a3d485fc8f4c8ef03
• https://git.kernel.org/stable/c/a8a9becbac93a9f54f4d565f1f3005eb08a7912f
• https://git.kernel.org/stable/c/cba54d142c43ec96d8c4d566f66439e8c0afded7
• https://git.kernel.org/stable/c/fc9d0e6e9d86fbefe7b8fe6ee49f4cf102add79d
• https://git.kernel.org/stable/c/fd6bf2721933d8c90bc4ce57f3e204c9295e7e3f

• Out-of-bounds read in Linux kernel core
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more
• Ubuntu update for linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-nvidia-tegra-igx
• Ubuntu update for linux, linux-aws, linux-aws-5.15 and more