CVE-2026-98503

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

packet: use ubuf_info completion for TX_RING packets

tpacket_snd sends skbs with frags pointing into its ring slots. Slots

are released when skb->destructor is called.

A call to skb_orphan calls skb->destructor before the skb is freed.

This can cause the slot to be reused while still linked into the skb.

Switch to standard zerocopy completion (ubuf_info) so the slot is only

released once all references to the payload are freed or copied.

Restore skb->destructor to standard sock_wfree.

The ubuf_info completion callback can be called with a NULL skb, but

only from net_zcopy_put and related API, used by zerocopy implementations

that hold their own reference on the uarg, such as MSG_ZEROCOPY. This

uarg is only ever completed from skb_zcopy_clear, so skb is always set.

To prevent userspace from aliasing in-flight state on shared ring

slots, allocate tpacket_uarg per packet, rather than per slot. This

adds a small allo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References