CVE-2026-98300

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().

tcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for

TCP_LISTEN since commit 073d89808c06 ("net: fix data-races around

sk->sk_forward_alloc").

However, there is still a small race window between tcp_v6_rcv()

and tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN

to TCP_CLOSE, causing skb_clone_and_charge_r() to be called

locklessly and resulting in the splat below. [0]

Let's avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well.

This is fine for non-listeners because tcp_rcv_state_process()

drops skb for TCP_CLOSE and opt_skb was freed immediately anyway.

[0]:

sk->sk_forward_alloc

WARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28

Modules linked in:

CPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full)

Hardware name: QEMU Sta

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References