CVE-2026-43198

Aliases:UBUNTU-CVE-2026-43198DEBIAN-CVE-2026-43198CGA-43m8-h6q2-jm57CGA-cw5p-r82m-j4q3CGA-gjfq-m7j6-m268CGA-m93g-53xj-xq25CGA-qxj8-974f-xpmm
Advisory lineage Upstream: 0 Downstream: 63
Modified
Published: 06 May 2026, 11:28
Last modified:14 Sept 2026, 11:58

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
0.3% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

06 May 2026, 11:28
Published
Vulnerability first disclosed
14 Sept 2026, 11:58
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.

CVSS Metrics

  • v4.0•HIGH•Score: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.30%• Percentile: 23%

Techniques & Countermeasures

  • CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

    The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

  • CWE-821•Incorrect Synchronization

    The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

Affected Systems

  • chainguard•linux-aws-6.12

    all

  • chainguard•linux-azure-6.12

    all

  • chainguard•linux-gcp-6.12

    all

  • chainguard•linux-qemu-6.12

    all

  • chainguard•linux-vmware-6.12

    all

  • debian•linux

    all | all | all | < 6.19.6-1

  • ubuntu•linux

    all | < 3.13.0-215.266 | < 4.4.0-284.318 | < 4.15.0-254.266 | < 5.4.0-234.254 | < 5.15.0-187.197 | < 6.8.0-137.137 | all

  • ubuntu•linux-allwinner-5.19

    all

  • ubuntu•linux-aws

    all | < 4.4.0-1157.163 | < 4.4.0-1195.210 | < 4.15.0-1195.208 | < 5.4.0-1162.173 | < 5.15.0-1113.120 | < 6.8.0-1062.65 | all

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

  • ubuntu•linux-aws-5.13

    all

  • ubuntu•linux-aws-5.15

    all | < 5.15.0-1114.121~20.04.1

  • ubuntu•linux-aws-5.19

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.4

    all | < 5.4.0-1162.173~18.04.1

  • ubuntu•linux-aws-5.8

    all

  • ubuntu•linux-aws-6.14

    all

  • ubuntu•linux-aws-6.17

    all

  • ubuntu•linux-aws-6.2

    all

  • ubuntu•linux-aws-6.5

    all

  • ubuntu•linux-aws-6.8

    all | < 6.8.0-1062.65~22.04.2

  • ubuntu•linux-aws-fips

    < 4.15.0-2133.139 | all | < 5.4.0-1163.174+fips1 | < 5.15.0-1113.120+fips1 | < 6.8.0-1062.65+fips1

  • ubuntu•linux-aws-hwe

    all | < 4.15.0-1195.208~16.04.1

  • ubuntu•linux-azure

    all | < 4.15.0-1205.220~14.04.1 | < 4.15.0-1205.220~16.04.1 | all | < 5.4.0-1167.173 | < 5.15.0-1118.127 | < 6.8.0-1064.72 | all

  • ubuntu•linux-azure-4.15

    < 4.15.0-1205.220

  • ubuntu•linux-azure-5.11

    all

  • ubuntu•linux-azure-5.13

    all

  • ubuntu•linux-azure-5.15

    all | < 5.15.0-1119.128~20.04.1

  • ubuntu•linux-azure-5.19

    all

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.4

    all | < 5.4.0-1167.173~18.04.1

  • ubuntu•linux-azure-5.8

    all

  • ubuntu•linux-azure-6.11

    all

  • ubuntu•linux-azure-6.14

    all

  • ubuntu•linux-azure-6.17

    < 6.17.0-1022.22

  • ubuntu•linux-azure-6.2

    all

  • ubuntu•linux-azure-6.5

    all

  • ubuntu•linux-azure-6.8

    < 6.8.0-1064.72~22.04.1

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fde

    all | < 5.15.0-1118.127 | < 6.8.0-1063.70 | all | all

  • ubuntu•linux-azure-fde-5.15

    all | < 5.15.0-1118.127~20.04.1

  • ubuntu•linux-azure-fde-5.19

    all

  • ubuntu•linux-azure-fde-6.14

    all

  • ubuntu•linux-azure-fde-6.17

    all

  • ubuntu•linux-azure-fde-6.2

    all

  • ubuntu•linux-azure-fde-6.8

    < 6.8.0-1063.70~22.04.1

  • ubuntu•linux-azure-fde-7.0

    all

  • ubuntu•linux-azure-fips

    < 4.15.0-2113.119 | all | < 5.4.0-1167.173+fips1 | < 5.15.0-1118.127+fips1 | < 6.8.0-1064.72+fips1

  • ubuntu•linux-azure-nvidia

    all

Showing first 50 affected entries in server-rendered view.

References (62)