CVE-2026-98276

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: lock the socket in sock_gettstamp()

sk->sk_flags must only be changed while holding the socket lock,

because sock_set_flag() and sock_reset_flag() use non atomic

operations (__set_bit() and __clear_bit()).

sock_gettstamp() is one of the last places where a bit of sk->sk_flags

is changed from a syscall without owning the socket lock, through

sock_enable_timestamp(sk, SOCK_TIMESTAMP).

sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags

without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,

sunrpc, wireguard) need a careful audit, this will be addressed in a

separate patch.

Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free

caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()

can cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,

because both threads perform a read-modify-write on the same word.

CPU 0 (bind) CPU 1 (SIOCGS

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References