AZL-85803
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-85803.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-85803
- Upstream
- Published
- 2026-05-06T12:16:38Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-43198 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix potential race in tcpv6synrecvsock()
Code in tcpv6synrecvsock() after the call to tcpv4synrecvsock() is done too late.
After tcpv4synrecvsock(), the child socket is already visible from TCP ehash table and other cpus might use it.
Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found.
Move the problematic code in tcpv6mappedchildinit() and call this new helper from tcpv4synrecvsock() before the ehash insertion.
This allows the removal of one tcpsyncmss(), since tcpv4synrecvsock() will call it with the correct context.
- References