CVE-2026-98643

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix out-of-bounds read of rtt_min in sock_ops

A sockops prog reading skops->rtt_min never checks the sk type: on the

tcp_conn_request() path sock_ops->sk is a request_sock (non-full), and the

ctx rewrite casts it to a tcp_sock (full) and reads rtt_min past the end of

the request_sock, returning dirty adjacent memory.

SEC("sockops")

int prog(struct bpf_sock_ops *skops)

{

switch (skops->op) {

case BPF_SOCK_OPS_RWND_INIT:

leak = skops->rtt_min; /* reads the request_sock OOB */

...

}

}

For instance one such read returned rtt_min=0xffff8881, the high half of a

leaked kernel pointer.

Guarding that cast is exactly what SOCK_OPS_GET_FIELD() does -- it checks

is_locked_tcp_sock and returns 0 when sock_ops->sk is not a locked full

socket. Every other tcp_sock field in sock_ops goes through it; rtt_min is

the only one open-coded, so it skips the check.

Read rtt_min through SOCK_OPS_GET_FIELD() too. rtt

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References